Administration and Configuration Guide
For Use with Red Hat JBoss Enterprise Application Platform 6
Edition 1
Nidhi Chaudhary
Lucas Costi
Russell Dickenson
Sande Gilda
Vikram Goyal
Eamon Logue
Darrin Mison
Scott Mumford
David Ryan
Misty Stanley-Jones
Keerat Verma
Tom Wells
Abstract
Chapter 1. Introduction
1.1. About Red Hat JBoss Enterprise Application Platform 6 (JBoss EAP 6)
1.2. About the Use of EAP_HOME in this Document
1.3. Features of JBoss EAP 6
Table 1.1. 6.1.0 Features
Feature | Description |
---|---|
Java Certification | Certified implementation of the Java Enterprise Edition 6 Full Profile and Web Profile specifications. |
Managed Domain |
|
Management Console and Management CLI | New interfaces are provided to manage the domain or standalone server. Manual editing of XML configuration files is no longer required. The Management CLI also offers batch mode that can script and automate management tasks. |
Simplified directory layout | The modules/ directory now contains the application server modules, instead of using common and server-specific lib/directories. The domain/ and standalone/ directories contain the artifacts and configuration files for domain and standalone deployments. |
Modular classloading mechanism | Modules are loaded and unloaded on demand to provide performance and security benefits and a faster start-up and restart time. |
Streamlined Data source management | Database drivers are deployed just like other services. In addition, datasources are created and managed directly in the Management Console or Management CLI. |
Faster start and stop time | JBoss EAP 6 uses fewer resources and is extremely efficient in its use of system resources. This is especially beneficial for developers. |
1.4. About JBoss EAP 6 Operating Modes
1.5. About Standalone Servers
1.6. About Managed Domains
domain.sh
or domain.bat
script is run. Unlike the domain controller, the host controllers are configured to delegate domain management tasks to it. The host controller on each host interacts with the domain controller to control the lifecycle of the application server instances running on its host and to assist the domain controller to manage them. Each host can contain multiple server groups. A server group is a set of server instances, which has JBoss EAP installed on it and are managed and configured as one. Since the domain controller manages the configuration and applications deployed onto server groups, each server in a server group shares the same configuration and deployments.
Figure 1.1. Graphical Representation of a Managed Domain
1.7. About the Domain Controller
- Maintain the domain's central management policy
- Ensure all host controllers are aware of its current contents
- Assist the host controllers in ensuring that all running JBoss EAP 6 instances are configured in accordance with this policy
domain/configuration/domain.xml
file, in the unzipped JBoss EAP 6 installation file, on the domain controller's host's filesystem.
domain/configuration/
directory of the host controller that is meant to run as the domain controller. This file is not mandatory for installations on host controllers that are not meant to run as a domain controller though, the presence of a domain.xml
file on such a server does no harm. The domain.xml file contains the configuration of the various profiles that can be configured to run on the server instances in a domain. A profile configuration includes the detailed configuration of the various subsystems that comprise a profile. The domain configuration also includes the definition of groups of sockets and the definition of server groups.
1.8. About Domain Controller Failover
1.9. About Host Controller
domain.sh
or domain.bat script
is run on a host. The primary responsibility of a host controller is server management. It delegates domain management tasks and is responsible for starting and stopping the individual application server processes that run on its host. It interacts with the domain controller to help manage the communication between the servers and the domain controller. Multiple host controllers of a domain can interact with only a single domain controller. Hence, all the host controllers and server instances running on a single domain mode can have a single domain controller and must belong to the same domain.
domain/configuration/host.xml
file located in the unzipped JBoss EAP 6 installation file on its host's filesystem. The host.xml
file contains the following configuration information that is specific to the particular host:
- List of the names of the actual JBoss EAP 6 instances that are meant to run from this installation
- Any of the following configurations:
- how the host controller contacts the domain controller to register itself and access the domain configuration
- how to find and contact a remote domain controller
- telling the host controller to itself act as the domain controller
- Configuration of items that are specific to the local physical installation. For example, named interface definitions declared in domain.xml can be mapped to an actual machine-specific IP address in host.xml. Abstract path names in domain.xml can be mapped to actual filesystem paths in host.xml.
1.10. About Server Groups
<server-group name="main-server-group" profile="default"> <socket-binding-group ref="standard-sockets"/> <deployments> <deployment name="foo.war_v1" runtime-name="foo.war"/> <deployment name="bar.ear" runtime-name="bar.ear"/> </deployments> </server-group>
- name: the name of the server group
- profile: the name of the profile for the server group
- socket-binding-group: the name of the default socket binding group to be used for servers in the group. This name can be overridden on a per-server basis in host.xml. If the socket-binding-group name is not provided in the server-group element, it must be provided for each server in the host.xml.
- deployments: the deployment content to be deployed on the servers in the group
- system-properties: the system properties to be set on servers in the group
- jvm: the default jvm settings for all servers in the group. The host controller merges these settings with any other configuration provided in host.xml to derive the settings to be used to launch the server's JVM.
1.11. About JBoss EAP 6 Profiles
Chapter 2. Application Server Management
2.1. Start JBoss EAP 6
2.1.1. Start JBoss EAP 6
2.1.2. Start JBoss EAP 6 as a Standalone Server
This topic covers the steps to start JBoss EAP 6 as a Standalone Server.
Procedure 2.1. Start the Platform Service as a Standalone Server
For Red Hat Enterprise Linux.
Run the command:EAP_HOME/bin/standalone.sh
For Microsoft Windows Server.
Run the command:EAP_HOME\bin\standalone.bat
Optional: Specify additional parameters.
To print a list of additional parameters to pass to the start-up scripts, use the-h
parameter.
The JBoss EAP 6 Standalone Server instance starts.
2.1.3. Start JBoss EAP 6 as a Managed Domain
The domain controller must be started before any slave servers in any server groups in the domain. Use this procedure first on the domain controller, and then on each associated host controller and each other host associated with the domain.
Procedure 2.2. Start the Platform Service as a Managed Domain
For Red Hat Enterprise Linux.
Run the command:EAP_HOME/bin/domain.sh
For Microsoft Windows Server.
Run the command:EAP_HOME\bin\domain.bat
Optional: Pass additional parameters to the start-up script.
For a list of parameters you can pass to the start-up script, use the-h
parameter.
The JBoss EAP 6 Managed Domain instance starts.
2.1.4. Start JBoss EAP 6 with an Alternative Configuration
Prerequisites
- Before using an alternate configuration file, prepare it using the default configuration as a template. For a Managed Domain, the configuration file needs to be placed in the
EAP_HOME/domain/configuration/
directory. For a Standalone Server, the configuration file should be placed in theEAP_HOME/standalone/configuration/
directory.
Note
EAP_HOME/docs/examples/configs/
directory. Use these examples to enable extra features such as clustering or the Transactions XTS API.
Procedure 2.3. Start the Instance with an Alternative Configuration
Managed Domain
For a Managed Domain, provide the file name of the configuration file as an option to the--domain-config
parameter. The file must be present in theEAP_HOME/domain/configuration/
directory, and you need to specify the path relative to that directory.Example 2.1. Using an alternate configuration file for a Managed Domain in Red Hat Enterprise Linux
[user@host bin]$ ./domain.sh --domain-config=
domain-alternate.xml
This example uses theEAP_HOME/domain/configuration/domain-alternate.xml
configuration file.Example 2.2. Using an alternate configuration file for a Managed Domain in Microsoft Windows Server
C:\EAP_HOME\bin> domain.bat --domain-config=
domain-alternate.xml
This example uses theEAP_HOME\domain\configuration\domain-alternate.xml
configuration file.Standalone server
For a Standalone Server, provide the filename of the configuration file as an option to the--server-config
parameter. The configuration file must be located in theEAP_HOME/standalone/configuration/
directory, and you need to specify the file path relative to that directory.Example 2.3. Using an alternate configuration file for a Standalone Server in Red Hat Enterprise Linux
[user@host bin]$ ./standalone.sh --server-config=
standalone-alternate.xml
This example uses theEAP_HOME/standalone/configuration/standalone-alternate.xml
configuration file.Example 2.4. Using an alternate configuration file for a Standalone Server in Microsoft Windows Server
C:\EAP_HOME\bin> standalone.bat --server-config=
standalone-alternate.xml
This example uses theEAP_HOME\standalone\configuration\standalone-alternative.xml
configuration file.
JBoss Enterprise Application Platform is now running, using your alternate configuration file.
2.1.5. Stop JBoss EAP 6
Note
Procedure 2.4. Stop a standalone instance of JBoss EAP 6
Stop an instance which was started interactively from a command prompt.
PressCtrl-C
in the terminal where JBoss EAP 6 is running.Stop an instance which was started as an operating system service.
Depending on your operating system, use one of the following procedures.Red Hat Enterprise Linux
For Red Hat Enterprise Linux, if you have written a service script, use itsstop
facility. This needs to be written into the script. Then you can useservice scriptname stop
, where scriptname is the name of your script.Microsoft Windows Server
In Microsoft Windows, use thenet service
command, or stop the service from the Services applet in the Control Panel.
Stop an instance which is running in the background (Red Hat Enterprise Linux)
- Locate the instance from the process list. One option is to run the command
ps aux |grep "[j]ava -server"
. This returns one result for each JBoss EAP 6 instance that is running on the local machine. - Send the process the
TERM
signal, by runningkill process_ID
, where process_ID is the number in the second field of theps aux
command above.
Each of these alternatives shuts JBoss EAP 6 down cleanly so that data is not lost.
2.1.6. Reference of Switches and Arguments to pass at Server Runtime
standalone.xml
, domain.xml
and host.xml
configuration files. This might include starting the server with an alternative set of socket bindings or a secondary configuration. A list of these available parameters can be accessed by passing the help switch at startup.
Example 2.5.
-h
or --help
switches. The results of the help switch are explained in the table below.
[localhost bin]$ standalone.sh -h
Table 2.1. Table of runtime switches and arguments
Argument or Switch | Description |
---|---|
--admin-only | Set the server's running type to ADMIN_ONLY. This will cause it to open administrative interfaces and accept management requests, but not start other runtime services or accept end user requests. |
-b=<value> | Set system property jboss.bind.address to the given value. |
-b <value> | Set system property jboss.bind.address to the given value. |
-b<interface>=<value> | Set system property jboss.bind.address.<interface> to the given value. |
-c=<config> | Name of the server configuration file to use. The default is standalone.xml . |
-c <config> | Name of the server configuration file to use. The default is standalone.xml . |
--debug [<port>] | Activate debug mode with an optional argument to specify the port. Only works if the launch script supports it. |
-D<name>[=<value>] | Set a system property. |
-h | Display the help message and exit. |
--help | Display the help message and exit. |
-P=<url> | Load system properties from the given URL. |
-P <url> | Load system properties from the given URL. |
--properties=<url> | Load system properties from the given URL. |
-S<name>[=<value>] | Set a security property. |
--server-config=<config> | Name of the server configuration file to use. The default is standalone.xml . |
-u=<value> | Set system property jboss.default.multicast.address to the given value. |
-u <value> | Set system property jboss.default.multicast.address to the given value. |
-V | Display the application server version and exit. |
-v | Display the application server version and exit. |
--version | Display the application server version and exit. |
2.2. Start and Stop Servers
2.2.1. Start and Stop Servers
A Standalone Server instance can be started by the command line scripts, and shut down from the Management CLI with the shutdown
command. If you require the instance again, run the startup process again as described in Section 2.1.2, “Start JBoss EAP 6 as a Standalone Server”.
Example 2.6. Stop a Standalone Server instance via the Management CLI
[standalone@localhost:9999 /] shutdown
If you are running a Managed Domain, the Management Console allows you to selectively start or stop specific servers in the domain. This includes server groups across the whole of the domain, as well as specific server instances on a host.
Example 2.7. Stop a Server Host in a Managed Domain via the Management CLI
shutdown
command is used to shut down a declared Managed Domain host. This example stops a server host named master by declaring the instance name before calling the shutdown operation. Use the tab key to assist with string completion and to expose visible variables such as available host values.
[domain@localhost:9999 /] /host=master:shutdown
Example 2.8. Start and Stop a Server Group in a Managed Domain via the Management CLI
main-server-group
by declaring the group before calling the start
and stop
operations. Use the tab key to assist with string completion and to expose visible variables such as available server group name values.
[domain@localhost:9999 /] /server-group=main-server-group:start-servers
[domain@localhost:9999 /] /server-group=main-server-group:stop-servers
Example 2.9. Start and Stop a Server Instance in a Managed Domain via the Management CLI
server-one
on the master
host by declaring the host and server configuration before calling the start
and stop
operations. Use the tab key to assist with string completion and to expose visible variables such as available host and server configuration values.
[domain@localhost:9999 /] /host=master/server-config=server-one:start
[domain@localhost:9999 /] /host=master/server-config=server-one:stop
2.2.2. Start a Server Using the Management Console
Prerequisites
Procedure 2.5. Start the Server
Navigate to Server Instances in the Management Console
- Select the Runtime tab from the top-right of the console.
- Select Domain Status → Server Instances from the menu on the left of the console.
Figure 2.1. Server Instances
Select a server
From the list of Server Instances, select the server you want to start. Servers that are running are indicated by a check mark.Click the Start button
Click on the Start button above the server list to open the confirmation dialogue box. Click the Confirm button to start the server.Figure 2.2. Confirm server modification
The selected server is started and running.
Figure 2.3. Started server
2.2.3. Stop a Server Using the Management Console
Prerequisites
Procedure 2.6. Stop a Server Using the Management Console
Navigate to Server Instances in the Management Console
- Select the Runtime tab from the top-right of the console.
- Select Domain Status → Server Instances from the menu on the left of the console.
Figure 2.4. Server Instances
Select a server
From the list of Server Instances, select the server you want to stop. Servers that are running are indicated by a check mark.Click the Stop button
Click on the Stop button above the server list to open the confirmation dialogue box. Click the Confirm button to stop the server.
The selected server is stopped.
Figure 2.5. Stopped server
2.3. Filesystem Paths
2.3.1. Filesystem Paths
domain.xml
, host.xml
and standalone.xml
configurations all include a section where paths can be declared. Other sections of the configuration can then reference those paths by their logical name, avoiding the declaration of the absolute path for each instance. This benefits configuration and administration efforts as it allows specific host configurations to resolve to universal logical names.
jboss.server.log.dir
path that points to the server's log
directory.
Example 2.10. Relative path example for the logging directory
<file relative-to="jboss.server.log.dir" path="server.log"/>
Table 2.2. Standard Paths
Value | Description |
---|---|
jboss.home | The root directory of the JBoss EAP 6 distribution. |
user.home | The user home directory. |
user.dir | The user's current working directory. |
java.home | The Java installation directory |
jboss.server.base.dir | The root directory for an individual server instance. |
jboss.server.data.dir | The directory the server will use for persistent data file storage. |
jboss.server.log.dir | The directory the server will use for log file storage. |
jboss.server.tmp.dir | The directory the server will use for temporary file storage. |
jboss.domain.servers.dir | The directory under which a host controller will create the working area for individual server instances in a managed domain. |
path
element to their configuration file. The following example shows a new relative path declaration relative to the root directory for the individual server instance.
Example 2.11. Format of a relative path
<path name="examplename" path="example/path" relative-to="jboss.server.data.dir"/>
Table 2.3. Path Attributes
Attribute | Description |
---|---|
name | The name of the path. |
path | The actual filesystem path. Treated as an absolute path, unless the relative-to attribute is specified, in which case the value is treated as relative to that path. |
relative-to | An optional attribute indicating the name of another previously named path, or of one of the standard paths provided by the system. |
path
element in a domain.xml
configuration file only requires the name attribute. It does not need to include any information indicating what the actual filesystem path is, as shown in the following example.
Example 2.12. Domain path example
<path name="example"/>
example
that the other parts of the domain.xml
configuration can reference. The actual filesystem location declared by example
is specific to the respective host.xml
configuration files of the host instances joining the domain groups. If this approach is used, there must be a path element in each machine's host.xml
that specifies what the actual filesystem path is.
Example 2.13. Host path example
<path name="example" path="path/to/example" />
path
element in a standalone.xml
must include the specification of the actual filesystem path.
2.4. Configuration File History
2.4.1. About JBoss EAP 6 Configuration Files
Table 2.4. Configuration File Locations
Server mode | Location | Purpose |
---|---|---|
domain.xml | EAP_HOME/domain/configuration/domain.xml | This is the main configuration file for a managed domain. Only the domain master reads this file. On other domain members, it can be removed. |
host.xml | EAP_HOME/domain/configuration/host.xml | This file includes configuration details specific to a physical host in a managed domain, such as network interfaces, socket bindings, the name of the host, and other host-specific details. The host.xml file includes all of the features of both host-master.xml and host-slave.xml , which are described below. This file is not present for standalone servers. |
host-master.xml | EAP_HOME/domain/configuration/host-master.xml | This file includes only the configuration details necessary to run a server as a managed domain master server. This file is not present for standalone servers. |
host-slave.xml | EAP_HOME/domain/configuration/host-slave.xml | This file includes only the configuration details necessary to run a server as a managed domain slave server. This file is not present for standalone servers. |
standalone.xml | EAP_HOME/standalone/configuration/standalone.xml | This is the default configuration file for a standalone server. It contains all information about the standalone server, including subsystems, networking, deployments, socket bindings, and other configurable details. This configuration is used automatically when you start your standalone server. |
standalone-full.xml | EAP_HOME/standalone/configuration/standalone-full.xml | This is an example configuration for a standalone server. It includes support for every possible subsystem except for those required for high availability. To use it, stop your server and restart using the following command: EAP_HOME/bin/standalone.sh -c standalone-full.xml |
standalone-ha.xml | EAP_HOME/standalone/configuration/standalone-ha.xml | This example configuration file enables all of the default subsystems and adds the mod_cluster and JGroups subsystems for a standalone server, so that it can participate in a high-availability or load-balancing cluster. This file is not applicable for a managed domain. To use this configuration, stop your server and restart using the following command: EAP_HOME/bin/standalone.sh -c standalone-ha.xml |
standalone-full-ha.xml | EAP_HOME/standalone/configuration/standalone-full-ha.xml | This is an example configuration for a standalone server. It includes support for every possible subsystem, including those required for high availability. To use it, stop your server and restart using the following command: EAP_HOME/bin/standalone.sh -c standalone-full-ha.xml |
2.4.2. Configuration File History
standalone.xml
, as well as the domain.xml
and host.xml
files. While these files may be modified by direct editing, the recommended method is to configure the application server model with the available management operations, including the Management CLI and the Management Console.
2.4.3. Start the Server with a Previous Configuration
standalone.xml
. The same concept applies to a managed domain with domain.xml
and host.xml
respectively.
- Identify the backed up version that you want to start. This example will recall the instance of the server model prior to the first modification after successfully booting up.
EAP_HOME/configuration/standalone_xml_history/current/standalone.v1.xml
- Start the server with this configuration of the backed up model by passing in the relative filename under
jboss.server.config.dir
.EAP_HOME/bin/standalone.sh --server-config=standalone_xml_history/current/standalone.v1.xml
The application server starts with the selected configuration.
2.4.4. Save a Configuration Snapshot Using the Management CLI
Configuration snapshots are a point-in-time copy of the current server configuration. These copies can be saved and loaded by the administrator.
standalone.xml
configuration file, but the same process applies to the domain.xml
and host.xml
configuration files.
Prerequisites
Procedure 2.7. Take a Configuration Snapshot and Save It
Save a snapshot
Run thetake-snapshot
operation to capture a copy of the current server configuration.[standalone@localhost:9999 /] :take-snapshot { "outcome" => "success", "result" => "/home/User/EAP_HOME/standalone/configuration/standalone_xml_history/snapshot/20110630-172258657standalone.xml"
A snapshot of the current server configuration has been saved.
2.4.5. Load a Configuration Snapshot
standalone.xml
file, but the same process applies to the domain.xml
and host.xml
files.
Procedure 2.8. Load a Configuration Snapshot
- Identify the snapshot to be loaded. This example will recall the following file from the snapshot directory. The default path for the snapshot files is as follows.
EAP_HOME/standalone/configuration/standalone_xml_history/snapshot/20110812-191301472standalone.xml
The snapshots are expressed by their relative paths, by which the above example can be written as follows.jboss.server.config.dir/standalone_xml_history/snapshot/20110812-191301472standalone.xml
- Start the server with the selected configuration snapshot by passing in the filename.
EAP_HOME/bin/standalone.sh --server-config=standalone_xml_history/snapshot/20110913-164449522standalone.xml
The server restarts with the configuration selected in the loaded snapshot.
2.4.6. Delete a Configuration Snapshot Using Management CLI
Prerequisites
standalone.xml
file, but the same process applies to the domain.xml
and host.xml
files.
Procedure 2.9. Delete a Specific Snapshot
- Identify the snapshot to be deleted. This example will delete the following file from the snapshot directory.
EAP_HOME/standalone/configuration/standalone_xml_history/snapshot/20110630-165714239standalone.xml
- Run the
:delete-snapshot
command to delete a specific snapshot, specifying the name of the snapshot as in the example below.[standalone@localhost:9999 /]
:delete-snapshot(name="20110630-165714239standalone.xml")
{"outcome" => "success"}
The snapshot has been deleted.
Procedure 2.10. Delete All Snapshots
- Run the
:delete-snapshot(name="all")
command to delete all snapshots as in the example below.[standalone@localhost:9999 /]
:delete-snapshot(name="all")
{"outcome" => "success"}
All snapshots have been deleted.
2.4.7. List All Configuration Snapshots Using Management CLI
Prerequisites
standalone.xml
file, but the same process applies to the domain.xml
and host.xml
files.
Procedure 2.11. List All Configuration Snapshots
List all snapshots
List all of the saved snapshots by running the:list-snapshots
command.[standalone@localhost:9999 /]
:list-snapshots
{ "outcome" => "success", "result" => { "directory" => "/home/hostname/EAP_HOME/standalone/configuration/standalone_xml_history/snapshot", "names" => [ "20110818-133719699standalone.xml", "20110809-141225039standalone.xml", "20110802-152010683standalone.xml", "20110808-161118457standalone.xml", "20110912-151949212standalone.xml", "20110804-162951670standalone.xml" ] } }
The snapshots are listed.
Chapter 3. Management Interfaces
3.1. Manage the Application Server
3.2. Management Application Programming Interfaces (APIs)
JBoss EAP 6 offers three different approaches to configure and manage servers, being a web interface, a command line client and a set of XML configuration files. While the recommended methods for editing the configuration file include the Management Console and Management CLI, edits made to the configuration by all three are always synchronized across the different views and finally persisted to the XML files. Note that edits made to the XML configuration files while a server instance is running will be overwritten by the server model.
The Management Console is an example of a web interface built with the Google Web Toolkit (GWT). The Management Console communicates with the server using the HTTP management interface. The HTTP API endpoint is the entry point for management clients that rely on the HTTP protocol to integrate with the management layer. It uses a JSON encoded protocol and a de-typed, RPC-style API to describe and execute management operations against a Managed Domain or Standalone Server. The HTTP API is used by the web console, but offers integration capabilities for a wide range of other clients too.
Example 3.1. HTTP API Configuration File Example
<management-interfaces> [...] <http-interface interface="management" port="9990"/> <management-interfaces>
Table 3.1. URLs to access the Management Console
URL | Description |
---|---|
http://localhost:9990/console | The Management Console accessed on the local host, controlling the Managed Domain configuration. |
http://hostname:9990/console | The Management Console accessed remotely, naming the host and controlling the Managed Domain configuration. |
http://hostname:9990/management | The HTTP Management API runs on the same port as the Management Console, displaying the raw attributes and values exposed to the API. |
An example of a Native API tool is the Management CLI. This management tool is available for a Managed Domain or Standalone Server instance, allowing the a user to connect to the domain controller or a Standalone Server instance and execute management operations available through the de-typed management model.
Example 3.2. Native API Configuration File Example
<management-interfaces> <native-interface interface="management" port="9999"/> [...] <management-interfaces>
3.3. About the Management Console and Management CLI
3.4. The Management Console
3.4.1. Management Console
3.4.2. Log in to the Management Console
Prerequisites
- JBoss EAP 6 must be running.
Procedure 3.1. Log in to the Management Console
Navigate to the Management Console start page
Navigate to the Management Console in your web browser. The default location is http://localhost:9990/console/, where port 9990 is predefined as the Management Console socket binding.Log in to the Management Console
Enter the username and password of the account that you created previously to log into the Management Console login screen.Figure 3.1. Log in screen for the Management Console
Result
- Managed domain
- Standalone server
3.4.3. Change the Language of the Management Console
Supported Languages
- German (de)
- Simplified Chinese (zh-Hans)
- Brazilian Portuguese (pt-BR)
- French (fr)
- Spanish (es)
- Japanese (ja)
Procedure 3.2. Change the Language of the Web-based Management Console
Log into the Management Console.
Log into the web-based Management Console.Open the Settings dialog.
Near the bottom right of the screen is a Settings label. Click it to open the settings for the Management Console.Select the desired language.
Select the desired language from the Locale selection box. Select Save. A confirmation box informs you that you need to reload the application. Click Confirm. Refresh your web browser to use the new locale.
3.4.4. Configure a Server Using the Management Console
Prerequisites
Procedure 3.3. Configure the Server
Navigate to the server's Server Configuration panel in the Management Console
- Select the Server tab from the top-right of the console.
- Expand the Server Configurations menu item on the left of the console and select the relevant server from the list.
Figure 3.2. Server configuration
Edit the server configuration
- Select the Edit button beneath the server list.
- Make changes to the configuration attributes.
- Select the Save button beneath the server list.
The server configuration is changed, and will take effect next time the server restarts.
3.4.5. Add a Deployment in the Management Console
Prerequisites
Procedure 3.4. Add and Verify a Deployment
Navigate to the Manage Deployments panel in the Management Console
- Select the Runtime tab from the top right of the console.
- For a standalone server, expand the Server menu item on the left of the console and select Manage Deployments. For a managed domain, expand the Domain menu item on the left of the console and select Manage Deployments.
The Manage Deployments panel appears.Figure 3.3. Manage standalone deployments
Add deployment content
Select the Add button in the top right of the Deployments panel. An Upload dialog box appears.Choose a file to deploy
In the dialog box, select the Choose File button. Browse to the file you want to deploy and select it for upload. Select the Next button to proceed once a file has been selected.Figure 3.4. Deployment selection
Verify deployment names
Verify the deployment name and runtime name that appear in the Upload dialog box. Select the Save button to upload the file once the names are verified.Figure 3.5. Verify deployment names
The selected content is uploaded to the server and is now ready for deployment.
Figure 3.6. Uploaded deployment on a standalone server instance
3.4.6. Create a New Server in the Management Console
Prerequisites
Procedure 3.5. Create a New Server Configuration
Navigate to the Server Configurations page in the Management Console
Select the Server tab from the top-right of the console.Create a new configuration
- Select the Add button at the top of the Server Configuration panel.
- Edit the basic server settings in the Create Server Configuration dialog.
- Select the Save button to save the new server configuration.
The new server is created and listed in the Server Configurations list.
3.4.7. Change the Default Log Levels Using the Management Console
Procedure 3.6. Edit the Logging Levels
Navigate to the Logging panel in the Management Console
- If you are working with a managed domain, select the Profiles tab from the top-right of the console, then select the relevant profile from the drop-down list on the left of the console.
- For either a managed domain or a standalone server, select the Core → Logging option from the menu on the left of the console.
- Click on the Log Categories tab in the top of the console.
Figure 3.7. Logging panel
Edit logger details
Edit the details for any of the entries in the Log Categories table.- Select an entry in the Log Categories table, then select the Edit button in the Details section below.
- Set the log level for the category with the Log Level drop-down box. Select the Save button when done.
The log levels for the relevant categories are now updated.
3.4.8. Create a New Server Group in the Management Console
Prerequisites
Procedure 3.7. Configure and Add a new Server Group
Navigate to the Server Groups view
Select the Hosts tab in the top-right corner.- Select the Group Configurations tab under the Server Groups menu in the left hand column.
Figure 3.8. The Server Groups view
Add a server group
Click the Add button to add a new server group.Configure the server group
- Enter a name for the server group.
- Select the profile you want to add the server group to.
- Select the socket binding you want to add the server group to.
- Select the Save button to save your new group.
Figure 3.9. The Create Server Group dialog
The new server group is visible in the Management Console.
3.5. The Management CLI
3.5.1. About the Management Command Line Interface (CLI)
3.5.2. Launch the Management CLI
Prerequisites
- Perform one of the following before accessing the Management CLI:
Procedure 3.8. Launch CLI in Linux or Windows
Launch the CLI in Linux
Run theEAP_HOME/bin/jboss-cli.sh
file by entering the following at a command line:$ EAP_HOME/bin/jboss-cli.sh
Launch the CLI in Windows
Run theEAP_HOME\bin\jboss-cli.bat
file by double-clicking it, or by entering the following at a command line:C:\>EAP_HOME\bin\jboss-cli.bat
3.5.3. Quit the Management CLI
Prerequisites
Procedure 3.9. Quit the Management CLI
Run the
quit
commandFrom the Management CLI, enter thequit
command:[domain@localhost:9999 /]
quit
Closed connection to localhost:9999
3.5.4. Connect to a Managed Server Instance Using the Management CLI
Prerequisites
Procedure 3.10. Connect to a Managed Server Instance
Run the
connect
commandFrom the Management CLI, enter theconnect
command:[disconnected /]
connect
Connected to domain controller at localhost:9999- Alternatively, to connect to a managed server when starting the Management CLI on a Linux system, use the
--connect
parameter:$
EAP_HOME/bin/jboss-cli.sh --connect
- The
--connect
parameter can be used to specify the host and port of the server. To connect to the address192.168.0.1
with the port value9999
the following would apply:$
EAP_HOME/bin/jboss-cli.sh --connect --controller=192.168.0.1:9999
3.5.5. Get Help with the Management CLI
The Management CLI features a help dialog with general and context sensitive options. The help commands dependent on the operation context require an established connection to either a standalone or domain controller. These commands will not appear in the listing unless the connection has been established.
Prerequisites
Procedure 3.11. General and Context-Sensitive Help
Run the
help
commandFrom the Management CLI, enter thehelp
command:[standalone@localhost:9999 /]
help
Get context sensitive help
From the Management CLI, enter thehelp -commands
extended command:[standalone@localhost:9999 /]
help --commands
- For a more detailed description of a specific command, execute the
help
command with'--help'
as the argument.[standalone@localhost:9999 /]
deploy --help
The CLI help information is displayed.
3.5.6. Use the Management CLI in Batch Mode
Batch processing allows a number of operation requests to be grouped in a sequence and executed together as a unit. If any of the operation requests in the sequence fail, the entire group of operations is rolled back.
Prerequisites
Procedure 3.12. Batch Mode Commands and Operations
Enter batch mode
Enter batch mode with thebatch
command.[standalone@localhost:9999 /] batch [standalone@localhost:9999 / #]
Batch mode is indicated by the hash symbol (#
) in the prompt.Add operation requests to the batch
Once in batch mode, enter operation requests as normal. The operation requests are added to the batch in the order they are entered.Refer to Section 3.5.8, “Use Operations and Commands in the Management CLI” for details on formatting operation requests.Run the batch
Once the entire sequence of operation requests is entered, run the batch with therun-batch
command.[standalone@localhost:9999 / #] run-batch The batch executed successfully.
Refer to Section 3.5.7, “CLI Batch Mode Commands” for a full list of commands available for working with batches.Batch commands stored in external files
Frequently run batch commands can be stored in an external text file and can either be loaded by passing the full path to the file as an argument to thebatch
command or executed directly by being an argument to therun-batch
command.You can create a batch command file using a text editor. Each command must be on a line by itself and the CLI should be able to access it.The following command will load amyscript.txt
file in the batch mode. All commands in this file will now be accessible to be edited or removed. New commands can be inserted. Changed made in this batch session do not persist to themyscript.txt
file.[standalone@localhost:9999 /] batch --file=myscript.txt
The following will instantly run the batch commands stored in the filemyscript.txt
[standalone@localhost:9999 /] run-batch --file=myscript.txt
The entered sequence of operation requests is completed as a batch.
3.5.7. CLI Batch Mode Commands
Table 3.2. CLI Batch Mode Commands
Command Name | Description |
---|---|
list-batch | List of the commands and operations in the current batch. |
edit-batch-line line-number edited-command | Edit a line in the current batch by providing the line number to edit and the edited command. Example: edit-batch-line 2 data-source disable --name=ExampleDS . |
move-batch-line fromline toline | Re-order the lines in the batch by specifying the line number you want to move as the first argument and its new position as the second argument. Example: move-batch-line 3 1 . |
remove-batch-line linenumber | Remove the batch command at the specified line. Example: remove-batch-line 3 . |
holdback-batch [batchname] |
You can postpone or store a current batch by using this command. Use this if you want to suddenly execute something in the CLI outside the batch. To return to this heldback batch, simply type
batch again at the CLI command line.
If you provide a batchname while using
holdback-batch command the batch will be stored under that name. To return to the named batch, use the command batch batchname . Calling the batch command without a batchname will start a new (unnamed) batch. There can be only one unnamed heldback batch.
To see a list of all heldback batches, use the
batch -l command.
|
discard-batch | Dicards the currently active batch. |
3.5.8. Use Operations and Commands in the Management CLI
Prerequisites
Procedure 3.13. Create, Configure and Execute Requests
Construct the operation request
Operation requests allow for low-level interaction with the management model. They provide a controlled way to edit server configurations. An operation request consists of three parts:- an address, prefixed with a slash (
/
). - an operation name, prefixed with a colon (
:
). - an optional set of parameters, contained within parentheses (
()
).
Determine the address
The configuration is presented as a hierarchical tree of addressable resources. Each resource node offers a different set of operations. The address specifies which resource node to perform the operation on. An address uses the following syntax:/node-type=node-name
- node-type is the resource node type. This maps to an element name in the configuration XML.
- node-name is the resource node name. This maps to the
name
attribute of the element in the configuration XML. - Separate each level of the resource tree with a slash (
/
).
Refer to the configuration XML files to determine the required address. TheEAP_HOME/standalone/configuration/standalone.xml
file holds the configuration for a standalone server and theEAP_HOME/domain/configuration/domain.xml
andEAP_HOME/domain/configuration/host.xml
files hold the configuration for a managed domain.Example 3.3. Example operation addresses
To perform an operation on the logging subsystem, use the following address in an operation request:/subsystem=logging
To perform an operation on the Java datasource, use the following address in an operation request:/subsystem=datasources/data-source=java
Determine the operation
Operations differ for each different type of resource node. An operation uses the following syntax::operation-name
- operation-name is the name of the operation to request.
Use theread-operation-names
operation on any resource address in a standalone server to list the available operations.Example 3.4. Available operations
To list all available operations for the logging subsystem, enter the following request for a standalone server:[standalone@localhost:9999 /] /subsystem=logging:read-operation-names { "outcome" => "success", "result" => [ "add", "read-attribute", "read-children-names", "read-children-resources", "read-children-types", "read-operation-description", "read-operation-names", "read-resource", "read-resource-description", "remove", "undefine-attribute", "whoami", "write-attribute" ] }
Determine any parameters
Each operation may require different parameters.Parameters use the following syntax:(parameter-name=parameter-value)
- parameter-name is the name of the parameter.
- parameter-value is the value of the parameter.
- Multiple parameters are separated by commas (
,
).
To determine any required parameters, perform theread-operation-description
command on a resource node, passing the operation name as a parameter. Refer to Example 3.5, “Determine operation parameters” for details.Example 3.5. Determine operation parameters
To determine any required parameters for theread-children-types
operation on the logging subsystem, enter theread-operation-description
command as follows:[standalone@localhost:9999 /] /subsystem=logging:read-operation-description(name=read-children-types) { "outcome" => "success", "result" => { "operation-name" => "read-children-types", "description" => "Gets the type names of all the children under the selected resource", "reply-properties" => { "type" => LIST, "description" => "The children types", "value-type" => STRING }, "read-only" => true } }
Enter the full operation request
Once the address, operation, and any parameters have been determined, enter the full operation request.Example 3.6. Example operation request
[standalone@localhost:9999 /]
/subsystem=web/connector=http:read-resource(recursive=true)
The management interface performs the operation request on the server configuration.
3.5.9. Reference of Management CLI Commands
Prerequisites
The topic Section 3.5.5, “Get Help with the Management CLI” describes how to access the Management CLI help features, including a help dialogue with general and context sensitive options. The help commands are dependent on the operation context and require an established connection to either a standalone or domain controller. These commands will not appear in the listing unless the connection has been established.
Table 3.3.
Command | Description |
---|---|
batch | Starts the batch mode by creating a new batch or, depending on the existing held back batches, re-activates one. If there are no held back batches this command invoked w/o arguments will start a new batch. If there is an unnamed held back batch, this command will re-activate it. If there are named held back batches, they can be activated by executing this command with the name of the held back batch as the argument. |
cd | Changes the current node path to the argument. The current node path is used as the address for operation requests that do not contain the address part. If an operation request does include the address, the included address is considered relative to the current node path. The current node path may end on a node-type. In that case, to execute an operation specifying a node-name would be sufficient, such as logging:read-resource. |
clear | Clears the screen. |
command | Allows you to add new, remove and list existing generic type commands. A generic type command is a command that is assigned to a specific node type and which allows you to perform any operation available for an instance of that type. It can also modify any of the properties exposed by the type on any existing instance. |
connect | Connects to the controller on the specified host and port. |
connection-factory | Defines a connection factory. |
data-source | Manages JDBC datasource configurations in the datasource subsystem. |
deploy | Deploys the application designated by the file path or enables an application that is pre-existing but disabled in the repository. If executed without arguments, this command will list all the existing deployments. |
help | Displays the help message. Can be used with the --commands argument to provide context sensitive results for the given commands. |
history | Displays the CLI command history in memory and displays a status of whether the history expansion is enabled or disabled. Can be used with arguments to clear, disable and enable the history expansion as required. |
jms-queue | Defines a JMS queue in the messaging subsystem. |
jms-topic | Defines a JMS topic in the messaging subsystem. |
ls | List the contents of the node path. By default the result is printed in columns using the whole width of the terminal. Using the -l switch will print results on one name per line. |
pwd | Prints the full node path of the current working node. |
quit | Terminates the command line interface. |
read-attribute | Prints the value and, depending on the arguments, the description of the attribute of a managed resource. |
read-operation | Displays the description of a specified operation, or lists all available operations if none is specified. |
undeploy | Undeploys an application when run with the name of the intended application. Can be run with arguments to remove the application from the repository also. Prints the list of all existing deployments when executed without an application specified. |
version | Prints the application server version and environment information. |
xa-data-source | Manages JDBC XA datasource configuration in the datasource subsystem. |
3.5.10. Reference of Management CLI Operations
Operations in the Management CLI can be exposed by using the read-operation-names
operation described in the topic Section 3.6.5, “Display the Operation Names using the Management CLI”. The operation descriptions can be exposed by using the read-operation-descriptions
operation described in the topic Section 3.6.4, “Display an Operation Description using the Management CLI”.
Table 3.4. Management CLI operations
Operation Name | Description |
---|---|
add-namespace | Adds a namespace prefix mapping to the namespaces attribute's map. |
add-schema-location | Adds a schema location mapping to the schema-locations attribute's map. |
delete-snapshot | Deletes a snapshot of the server configuration from the snapshots directory. |
full-replace-deployment | Add previously uploaded deployment content to the list of content available for use, replace existing content of the same name in the runtime, and remove the replaced content from the list of content available for use. Refer to link for further information. |
list-snapshots | Lists the snapshots of the server configuration saved in the snapshots directory. |
read-attribute | Displays the value of an attribute for the selected resource. |
read-children-names | Displays the names of all children under the selected resource with the given type. |
read-children-resources | Displays information about all of a resource's children that are of a given type. |
read-children-types | Displays the type names of all the children under the selected resource. |
read-config-as-xml | Reads the current configuration and displays it in XML format. |
read-operation-description | Displays the details of an operation on the given resource. |
read-operation-names | Displays the names of all the operations for the given resource. |
read-resource | Displays a model resource's attribute values along with either basic or complete information about any child resources. |
read-resource-description | Displays the description of a resource's attributes, types of children and operations. |
reload | Reloads the server by shutting all services down and restarting. |
remove-namespace | Removes a namespace prefix mapping from the namespaces attribute map. |
remove-schema-location | Removes a schema location mapping from the schema-locations attribute map. |
replace-deployment | Replace existing content in the runtime with new content. The new content must have been previously uploaded to the deployment content repository. |
resolve-expression | Operation that accepts an expression as input or a string that can be parsed into an expression, and resolves it against the local system properties and environment variables. |
resolve-internet-address | Takes a set of interface resolution criteria and finds an IP address on the local machine that matches the criteria, or fails if no matching IP address can be found. |
server-set-restart-required | Puts the server into a restart-required mode |
shutdown | Shuts down the server via a call to System.exit(0) . |
start-servers | Starts all configured servers in a Managed Domain that are not currently running. |
stop-servers | Stops all servers currently running in a Managed Domain. |
take-snapshot | Takes a snapshot of the server configuration and saves it to the snapshots directory. |
upload-deployment-bytes | Indicates that the deployment content in the included byte array should be added to the deployment content repository. Note that this operation does not indicate the content should be deployed into the runtime. |
upload-deployment-stream | Indicates that the deployment content available at the included input stream index should be added to the deployment content repository. Note that this operation does not indicate the content should be deployed into the runtime. |
upload-deployment-url | Indicates that the deployment content available at the included URL should be added to the deployment content repository. Note that this operation does not indicate the content should be deployed into the runtime. |
validate-address | Validates the operation's address. |
write-attribute | Sets the value of an attribute for the selected resource. |
3.6. Management CLI Operations
3.6.1. Display the Attributes of a Resource with the Management CLI
Prerequisites
The read-attribute
operation is a global operation used to read the current runtime value of a selected attribute. It can be used to expose only the values that have been set by the user, ignoring any default or undefined values. The request properties include the following parameters.
Request Properties
name
- The name of the attribute to get the value for under the selected resource.
include-defaults
- A Boolean parameter that can be set to
false
to restrict the operation results to only show attributes set by the user and ignore default values.
Procedure 3.14. Display the Current Runtime Value of a Selected Attribute
Run the
read-attribute
operationFrom the Management CLI, use theread-attribute
operation to display the value of a resource attribute. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.[standalone@localhost:9999 /]
:read-attribute(name=name-of-attribute)
read-attribute
operation is the ability to expose the current runtime value of a specific attribute. Similar results can be achieved with the read-resource
operation, but only with the addition of the include-runtime
request property, and only as part of a list of all available resources for that node. The read-attribute
operation is intended for fine-grained attribute queries, as the following example shows.
Example 3.7. Run the read-attribute
operation to expose the public interface IP
read-attribute
to return the exact value in the current runtime.
[standalone@localhost:9999 /] /interface=public:read-attribute(name=resolved-address) { "outcome" => "success", "result" => "127.0.0.1" }
resolved-address
attribute is a runtime value, so it is not displayed in the results of the standard read-resource
operation.
[standalone@localhost:9999 /] /interface=public:read-resource { "outcome" => "success", "result" => { "any" => undefined, "any-address" => undefined, "any-ipv4-address" => undefined, "any-ipv6-address" => undefined, "inet-address" => expression "${jboss.bind.address:127.0.0.1}", "link-local-address" => undefined, "loopback" => undefined, "loopback-address" => undefined, "multicast" => undefined, "name" => "public", "nic" => undefined, "nic-match" => undefined, "not" => undefined, "point-to-point" => undefined, "public-address" => undefined, "site-local-address" => undefined, "subnet-match" => undefined, "up" => undefined, "virtual" => undefined } }
resolved-address
and other runtime values, you must use the include-runtime
request property.
[standalone@localhost:9999 /] /interface=public:read-resource(include-runtime=true) { "outcome" => "success", "result" => { "any" => undefined, "any-address" => undefined, "any-ipv4-address" => undefined, "any-ipv6-address" => undefined, "inet-address" => expression "${jboss.bind.address:127.0.0.1}", "link-local-address" => undefined, "loopback" => undefined, "loopback-address" => undefined, "multicast" => undefined, "name" => "public", "nic" => undefined, "nic-match" => undefined, "not" => undefined, "point-to-point" => undefined, "public-address" => undefined, "resolved-address" => "127.0.0.1", "site-local-address" => undefined, "subnet-match" => undefined, "up" => undefined, "virtual" => undefined } }
The current runtime attribute value is displayed.
3.6.2. Display the Active User in the Management CLI
Prerequisites
The whoami
operation is a global operation used to identify the attributes of the current active user. The operation exposes the identity of the username and the realm that they are assigned to. The whoami
operation is useful for administrators managing multiple users accounts across multiple realms, or to assist in keeping track of active users across domain instances with multiple terminal session and users accounts.
Procedure 3.15. Display the Active User in the Management CLI Using the whoami
Operation
Run the
whoami
operationFrom the Management CLI, use thewhoami
operation to display the active user account.[standalone@localhost:9999 /]
:whoami
The following example uses thewhoami
operation in a standalone server instance to show that the active user isusername
, and that the user is assigned to theManagementRealm
realm.Example 3.8. Use the
whoami
in a standalone instance[standalone@localhost:9999 /]:whoami { "outcome" => "success", "result" => {"identity" => { "username" => "username", "realm" => "ManagementRealm" }} }
Your current active user account is displayed.
3.6.3. Display System and Server Information in the Management CLI
Prerequisites
Procedure 3.16. Display System and Server Information in the Management CLI
Run the
version
commandFrom the Management CLI, enter theversion
command:[domain@localhost:9999 /]
version
Your application server version and environment information is displayed.
3.6.4. Display an Operation Description using the Management CLI
Prerequisites
Procedure 3.17. Execute the Command in Management CLI
Run the
read-operation-description
operationFrom the Management CLI, useread-operation-description
to display information about the operation. The operation requires additional parameters in the format of a key-value pair to indicate which operation to display. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.[standalone@localhost:9999 /]
:read-operation-description(name=name-of-operation)
Example 3.9. Display the list-snapshots operation description
list-snapshots
operation.
[standalone@localhost:9999 /] :read-operation-description(name=list-snapshots) { "outcome" => "success", "result" => { "operation-name" => "list-snapshots", "description" => "Lists the snapshots", "reply-properties" => { "type" => OBJECT, "value-type" => { "directory" => { "type" => STRING, "description" => "The directory where the snapshots are stored" }, "names" => { "type" => LIST, "value-type" => STRING, "description" => "The names of the snapshots within the snapshots directory" } } }, "read-only" => false } }
The description is displayed for the chosen operation.
3.6.5. Display the Operation Names using the Management CLI
Prerequisites
Procedure 3.18. Execute the Command in Management CLI
Run the
read-operation-names
operationFrom the Management CLI, use theread-operation-names
operation to display the names of the available operations. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.[standalone@localhost:9999 /]
:read-operation-names
Example 3.10. Display the operation names using the Management CLI
read-operation-names
operation.
[standalone@localhost:9999 /]:read-operation-names
{
"outcome" => "success",
"result" => [
"add-namespace",
"add-schema-location",
"delete-snapshot",
"full-replace-deployment",
"list-snapshots",
"read-attribute",
"read-children-names",
"read-children-resources",
"read-children-types",
"read-config-as-xml",
"read-operation-description",
"read-operation-names",
"read-resource",
"read-resource-description",
"reload",
"remove-namespace",
"remove-schema-location",
"replace-deployment",
"shutdown",
"take-snapshot",
"upload-deployment-bytes",
"upload-deployment-stream",
"upload-deployment-url",
"validate-address",
"write-attribute"
]
}
The available operation names are displayed.
3.6.6. Display Available Resources using the Management CLI
Prerequisites
The read-resource
operation is a global operation used to read resource values. It can be used to expose either basic or complete information about the resources of the current or child nodes, along with a range of request properties to expand or limit the scope of the operation results. The request properties include the following parameters.
Request Properties
recursive
- Whether to recursively include complete information about child resources.
recursive-depth
- The depth to which information about child resources should be included.
proxies
- Whether to include remote resources in a recursive query. For example including the host level resources from slave Host Controllers in a query of the Domain Controller.
include-runtime
- Whether to include runtime attributes in the response, such as attribute values that do not come from the persistent configuration. This request property is set to false by default.
include-defaults
- A boolean request property that serves to enable or disable the reading of default attributes. When set to false only the attributes set by the user are returned, ignoring any that remain undefined.
Procedure 3.19. Execute the Command in Management CLI
Run the
read-resource
operationFrom the Management CLI, use theread-resource
operation to display the available resources.[standalone@localhost:9999 /]
:read-resource
The following example shows how you might use theread-resource
operation on a standalone server instance to expose general resource information. The results resemble thestandalone.xml
configuration file, displaying the system resources, extensions, interfaces and subsystems installed or configured for the server instance. These can be further queried directly.Example 3.11. Using the
read-resource
operation at the root level[standalone@localhost:9999 /]:read-resource { "outcome" => "success", "result" => { "deployment" => undefined, "deployment-overlay" => undefined, "management-major-version" => 1, "management-micro-version" => 0, "management-minor-version" => 4, "name" => "longgrass", "namespaces" => [], "product-name" => "EAP", "product-version" => "6.1.0.GA", "release-codename" => "Janus", "release-version" => "7.2.0.Final-redhat-3", "schema-locations" => [], "system-property" => undefined, "core-service" => { "management" => undefined, "service-container" => undefined, "server-environment" => undefined, "platform-mbean" => undefined }, "extension" => { "org.jboss.as.clustering.infinispan" => undefined, "org.jboss.as.connector" => undefined, "org.jboss.as.deployment-scanner" => undefined, "org.jboss.as.ee" => undefined, "org.jboss.as.ejb3" => undefined, "org.jboss.as.jaxrs" => undefined, "org.jboss.as.jdr" => undefined, "org.jboss.as.jmx" => undefined, "org.jboss.as.jpa" => undefined, "org.jboss.as.jsf" => undefined, "org.jboss.as.logging" => undefined, "org.jboss.as.mail" => undefined, "org.jboss.as.naming" => undefined, "org.jboss.as.pojo" => undefined, "org.jboss.as.remoting" => undefined, "org.jboss.as.sar" => undefined, "org.jboss.as.security" => undefined, "org.jboss.as.threads" => undefined, "org.jboss.as.transactions" => undefined, "org.jboss.as.web" => undefined, "org.jboss.as.webservices" => undefined, "org.jboss.as.weld" => undefined }, "interface" => { "management" => undefined, "public" => undefined, "unsecure" => undefined }, "path" => { "jboss.server.temp.dir" => undefined, "user.home" => undefined, "jboss.server.base.dir" => undefined, "java.home" => undefined, "user.dir" => undefined, "jboss.server.data.dir" => undefined, "jboss.home.dir" => undefined, "jboss.server.log.dir" => undefined, "jboss.server.config.dir" => undefined, "jboss.controller.temp.dir" => undefined }, "socket-binding-group" => {"standard-sockets" => undefined}, "subsystem" => { "logging" => undefined, "datasources" => undefined, "deployment-scanner" => undefined, "ee" => undefined, "ejb3" => undefined, "infinispan" => undefined, "jaxrs" => undefined, "jca" => undefined, "jdr" => undefined, "jmx" => undefined, "jpa" => undefined, "jsf" => undefined, "mail" => undefined, "naming" => undefined, "pojo" => undefined, "remoting" => undefined, "resource-adapters" => undefined, "sar" => undefined, "security" => undefined, "threads" => undefined, "transactions" => undefined, "web" => undefined, "webservices" => undefined, "weld" => undefined } } }
Run the
read-resource
operation against a child nodeTheread-resource
operation can be run to query child nodes from the root. The structure of the operation first defines the node to expose, and then appends the operation to run against it.[standalone@localhost:9999 /]
/subsystem=web/connector=http:read-resource
In the following example, specific resource information about a web subsystem component can be exposed by directing theread-resource
operation towards the specific web subsystem node.Example 3.12. Expose child node resources from the root node
[standalone@localhost:9999 /] /subsystem=web/connector=http:read-resource { "outcome" => "success", "result" => { "configuration" => undefined, "enable-lookups" => false, "enabled" => true, "executor" => undefined, "max-connections" => undefined, "max-post-size" => 2097152, "max-save-post-size" => 4096, "name" => "http", "protocol" => "HTTP/1.1", "proxy-name" => undefined, "proxy-port" => undefined, "redirect-port" => 443, "scheme" => "http", "secure" => false, "socket-binding" => "http", "ssl" => undefined, "virtual-server" => undefined } }
The same results are possible by using thecd
command to navigate into the child nodes and run theread-resource
operation directly.Example 3.13. Expose child node resources by changing directories
[standalone@localhost:9999 /] cd subsystem=web
[standalone@localhost:9999 subsystem=web] cd connector=http
[standalone@localhost:9999 connector=http] :read-resource { "outcome" => "success", "result" => { "configuration" => undefined, "enable-lookups" => false, "enabled" => true, "executor" => undefined, "max-connections" => undefined, "max-post-size" => 2097152, "max-save-post-size" => 4096, "name" => "http", "protocol" => "HTTP/1.1", "proxy-name" => undefined, "proxy-port" => undefined, "redirect-port" => 443, "scheme" => "http", "secure" => false, "socket-binding" => "http", "ssl" => undefined, "virtual-server" => undefined } }
Use the recursive parameter to include active values in results
The recursive parameter can be used to expose the values of all attributes, including non-persistent values, those passed at startup, or other attributes otherwise active in the runtime model.[standalone@localhost:9999 /]
/interface=public:read-resource(include-runtime=true)
Compared to the previous example, the inclusion of theinclude-runtime
request property exposes additional active attributes, such as the bytes sent and bytes received by the HTTP connector.Example 3.14. Expose additional and active values with the
include-runtime
parameter[standalone@localhost:9999 /] /subsystem=web/connector=http:read-resource(include-runtime=true) { "outcome" => "success", "result" => { "any" => undefined, "any-address" => undefined, "any-ipv4-address" => undefined, "any-ipv6-address" => undefined, "inet-address" => expression "${jboss.bind.address:127.0.0.1}", "link-local-address" => undefined, "loopback" => undefined, "loopback-address" => undefined, "multicast" => undefined, "name" => "public", "nic" => undefined, "nic-match" => undefined, "not" => undefined, "point-to-point" => undefined, "public-address" => undefined, "resolved-address" => "127.0.0.1", "site-local-address" => undefined, "subnet-match" => undefined, "up" => undefined, "virtual" => undefined } }
3.6.7. Display Available Resource Descriptions using the Management CLI
Prerequisites
Procedure 3.20. Execute the Command in Management CLI
Run the
read-resource-description
operationFrom the Management CLI, use theread-resource-description
operation to read and display the available resources. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.[standalone@localhost:9999 /]
:read-resource-description
Use optional parameters
Theread-resource-description
operation allows the use of the additional parameters.- Use the
operations
parameter to include descriptions of the resource's operations.[standalone@localhost:9999 /]
:read-resource-description(operations=true)
- Use the
inherited
parameter to include or exclude descriptions of the resource's inherited operations. The default state is true.[standalone@localhost:9999 /]
:read-resource-description(inherited=false)
- Use the
recursive
parameter to include recursive descriptions of the child resources.[standalone@localhost:9999 /]
:read-resource-description(recursive=true)
- Use the
locale
parameter to get the resource description in. If null, the default locale will be used.[standalone@localhost:9999 /]
:read-resource-description(locale=true)
Descriptions of the available resources are displayed.
3.6.8. Reload the Application Server using the Management CLI
Prerequisites
Procedure 3.21. Reload the Application Server
Run the
reload
operationFrom the Management CLI, use thereload
operation to shut the server down via theSystem.exit(0)
system call. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.[standalone@localhost:9999 /]
:reload
{"outcome" => "success"}
The application server reloads by shutting down all services and starting the runtime again. The Management CLI automatically reconnects.
3.6.9. Shut the Application Server down using the Management CLI
Prerequisites
Procedure 3.22. Shut down the Application Server
Run the
shutdown
operation- From the Management CLI, use the
shutdown
operation to shut the server down via theSystem.exit(0)
system call. For more details on operation requests, refer to the topic Section 3.5.8, “Use Operations and Commands in the Management CLI”.- In the standalone mode, use the following command:
[standalone@localhost:9999 /]
:shutdown
- In the domain mode, use the following command with the appropriate host name:
[domain@localhost:9999 /]
/host=master:shutdown
- To connect to a detached CLI instance and shut down the server, execute the following command:
jboss-cli.sh --connect command=:shutdown
- To connect to a remote CLI instance and shut down the server, execute the following command:
[disconnected /] connect IP_ADDRESS Connected to IP_ADDRESS:PORT_NUMBER [192.168.1.10:9999 /] :shutdown
Replace IP_ADDRESS with the IP address of your instance.
The application server is shut down. The Management CLI will be disconnected as the runtime is unavailable.
3.6.10. Configure an Attribute with the Management CLI
Prerequisites
The write-attribute
operation is a global operation used to write or modify a selected resource attribute. You can use the operation to make persistent changes and to modify the configuration settings of your managed server instances. The request properties include the following parameters.
Request Properties
name
- The name of the attribute to set the value for under the selected resource.
value
- The desired value of the attribute under the selected resource. May be null if the underlying model supports null values.
Procedure 3.23. Configure a Resource Attribute with the Management CLI
Run the
write-attribute
operationFrom the Management CLI, use thewrite-attribute
operation to modify the value of a resource attribute. The operation can be run at the child node of the resource or at the root node of the Management CLI where the full resource path is specified.
Example 3.15. Disable the deployment scanner with the write-attribute
operation
write-attribute
operation to disable the deployment scanner. The operation is run from the root node, using tab completion to aid in populating the correct resource path.
[standalone@localhost:9999 /] /subsystem=deployment-scanner/scanner=default:write-attribute(name=scan-enabled,value=false) {"outcome" => "success"}
read-attribute
operation.
[standalone@localhost:9999 /] /subsystem=deployment-scanner/scanner=default:read-attribute(name=scan-enabled) { "outcome" => "success", "result" => false }
read-resource
operation. In the following example, this particular configuration shows the scan-enabled
attribute is now set to false
.
[standalone@localhost:9999 /] /subsystem=deployment-scanner/scanner=default:read-resource { "outcome" => "success", "result" => { "auto-deploy-exploded" => false, "auto-deploy-xml" => true, "auto-deploy-zipped" => true, "deployment-timeout" => 600, "path" => "deployments", "relative-to" => "jboss.server.base.dir", "scan-enabled" => false, "scan-interval" => 5000 } }
The resource attribute is updated.
3.7. The Management CLI Command History
3.7.1. Use the Management CLI Command History
.jboss-cli-history
. This history file is configured by default to record up to a maximum of 500 CLI commands.
history
command by itself will return the history of the current session, or with additional arguments will disable, enable or clear the history from the session memory. The Management CLI also features the ability to use your keyboard's arrow keys to go back and forth in the history of commands and operations.
Functions of the Management CLI history
3.7.2. Show the Management CLI Command history
Prerequisites
Procedure 3.24. Show the Management CLI Command History
Run the
history
commandFrom the Management CLI, enter thehistory
command:[standalone@localhost:9999 /]
history
The CLI command history stored in memory since the CLI startup or the history clear command is displayed.
3.7.3. Clear the Management CLI Command history
Prerequisites
Procedure 3.25. Clear the Management CLI Command history
Run the
history --clear
commandFrom the Management CLI, enter thehistory --clear
command:[standalone@localhost:9999 /]
history --clear
The history of commands recorded since the CLI startup is cleared from the session memory. The command history is still present in the .jboss-cli-history
file saved to the user's home directory.
3.7.4. Disable the Management CLI Command history
Prerequisites
Procedure 3.26. Disable the Management CLI Command history
Run the
history --disable
commandFrom the Management CLI, enter thehistory --disable
command:[standalone@localhost:9999 /]
history --disable
Commands made in the CLI will not be recorded either in memory or in the .jboss-cli-history
file saved to the user's home directory.
3.7.5. Enable the Management CLI Command history
Prerequisites
Procedure 3.27. Enable the Management CLI Command history
Run the
history --enable
commandFrom the Management CLI, enter thehistory --enable
command:[standalone@localhost:9999 /]
history --enable
Commands made in the CLI are recorded in memory and in the .jboss-cli-history
file saved to the user's home directory.
Chapter 4. User Management
4.1. User Creation
4.1.1. Add the Initial User for the Management Interfaces
The management interfaces in JBoss EAP 6 are secured by default as there are no user accounts initially available, unless you have installed the platform using the graphical installer. This is a security precaution to prevent security breaches from remote systems due to simple configuration errors. Local non-HTTP access is protected by a SASL mechanism, with a negotiation happening between the client and server each time the client connects for the first time from the localhost.
Note
Procedure 4.1. Create the Initial Administrative User for the Remote Management Interfaces
Invoke the
add-user.sh
oradd-user.bat
script.Change to theEAP_HOME/bin/
directory. Invoke the appropriate script for your operating system.- Red Hat Enterprise Linux
[user@host bin]$
./add-user.sh- Microsoft Windows Server
C:\bin>
add-user.bat
Choose to add a Management user.
Select optiona
to add a Management user. This user is added to theManagementRealm
and is authorized to perform management operations using the web-based Management Console or command-line based Management CLI. The other choice,b
, adds a user to theApplicationRealm
, and provides no particular permissions. That realm is provided for use with applications.Choose the realm for the user.
The next prompt refers to the realm where the user will be added. For a user with permissions to manage JBoss EAP 6, choose the default, which isManagementRealm
.Enter the desired username and password.
When prompted, enter the security realm, username and password. Pressing ENTER selects the default realm ofManagementRealm
, which allows the user to administer JBoss EAP 6 using the management interfaces. You must add at least one user to this realm. You are prompted to confirm the information. If you are satisfied, typeyes
.Choose whether the user represents a remote JBoss EAP 6 server instance.
Besides administrators, the other type of user which occasionally needs to be added to JBoss EAP 6 in theManagementRealm
is a user representing another instance of JBoss EAP 6, which needs to be able to authenticate to join a cluster as a member. The next prompt allows you to designate your added user for this purpose. If you selectyes
, you will be given a hashedsecret
value, representing the user's password, which would need to be added to a different configuration file. For the purposes of this task, answerno
to this question.Enter additional users.
You can enter additional users if desired, by repeating the procedure. You can also add them at any time on a running system. Instead of choosing the default security realm, you can add users to other realms to fine-tune their authorizations.Create users non-interactively.
You can create users non-interactively, by passing in each parameter at the command line. This approach is not recommended on shared systems, because the passwords will be visible in log and history files. The syntax for the command, using the management realm, is:[user@host bin]$
./add-user.sh username passwordTo use the application realm, use the-a
parameter.[user@host bin]$
./add-user.sh -a username password- You can suppress the normal output of the add-user script by passing the
--silent
parameter. This applies only if the minimum parameters ifusername
andpassword
have been specified. Error messages will still be shown.
Any users you add are activated within the security realms you have specified. Users active within the ManagementRealm
realm are able to manage JBoss EAP 6 from remote systems.
4.1.2. Add a User to the Management Interface
Chapter 5. Network and Port Configuration
5.1. Interfaces
5.1.1. About Interfaces
domain.xml
, host.xml
and standalone.xml
configuration files all include interface declarations. The declaration criteria can reference a wildcard address or specify a set of one of more characteristics that an interface or address must have in order to be a valid match. The following examples show multiple possible configurations of interface declarations, typically defined in either the standalone.xml
or host.xml
configuration files. This allows any remote host groups to maintain their own specific interface attributes, while still allowing reference to the any interface groups in the domain.xml
configuration file of the domain controller.
inet-address
value specified for both the management
and public
relative name groups.
Example 5.1. An interface group created with an inet-address value
<interfaces> <interface name="management"> <inet-address value="127.0.0.1"/> </interface> <interface name="public"> <inet-address value="127.0.0.1"/> </interface> </interfaces>
any-address
element to declare a wildcard address.
Example 5.2. A global group created with a wildcard declaration
<interface name="global"> <!-- Use the wild-card address --> <any-address/> </interface>
external
.
Example 5.3. An external group created with an NIC value
<interface name="external"> <nic name="eth0"/> </interface>
Example 5.4. A default group created with specific conditional values
<interface name="default"> <!-- Match any interface/address on the right subnet if it's up, supports multicast, and isn't point-to-point --> <subnet-match value="192.168.0.0/16"/> <up/> <multicast/> <not> <point-to-point/> </not> </interface>
5.1.2. Configure Interfaces
standalone.xml
and host.xml
configuration files offer three named interfaces with relative interface tokens for each. You can use the Management Console or Management CLI to configure additional attributes and values, as listed in the table below. You can also replace the relative interface bindings with specific values as required. Note that if you do so, you will be unable to pass an interface value at server runtime, as the -b
switch can only override a relative value.
Example 5.5. Default Interface Configurations
<interfaces> <interface name="management"> <inet-address value="${jboss.bind.address.management:127.0.0.1}"/> </interface> <interface name="public"> <inet-address value="${jboss.bind.address:127.0.0.1}"/> </interface> <interface name="unsecure"> <inet-address value="${jboss.bind.address.unsecure:127.0.0.1}"/> </interface> </interfaces>
Table 5.1. Interface Attributes and Values
Interface Element | Description |
---|---|
any | Empty element of the address exclusion type, used to constrain the selection criteria. |
any-address | Empty element indicating that sockets using this interface should be bound to a wildcard address. The IPv6 wildcard address (::) will be used unless the java.net.preferIpV4Stack system property is set to true, in which case the IPv4 wildcard address (0.0.0.0) will be used. If a socket is bound to an IPv6 anylocal address on a dual-stack machine, it can accept both IPv6 and IPv4 traffic; if it is bound to an IPv4 (IPv4-mapped) anylocal address, it can only accept IPv4 traffic. |
any-ipv4-address | Empty element indicating that sockets using this interface should be bound to the IPv4 wildcard address (0.0.0.0). |
any-ipv6-address | Empty element indicating that sockets using this interface should be bound to the IPv6 wildcard address (::). |
inet-address | Either a IP address in IPv6 or IPv4 dotted decimal notation, or a hostname that can be resolved to an IP address. |
link-local-address | Empty element indicating that part of the selection criteria for an interface should be whether or not an address associated with it is link-local. |
loopback | Empty element indicating that part of the selection criteria for an interface should be whether or not it is a loopback interface. |
loopback-address | A loopback address that may not actually be configured on the machine's loopback interface. Differs from inet-addressType in that the given value will be used even if no NIC can be found that has the IP address associated with it. |
multicast | Empty element indicating that part of the selection criteria for an interface should be whether or not it supports multicast. |
nic | The name of a network interface (e.g. eth0, eth1, lo). |
nic-match | A regular expression against which the names of the network interfaces available on the machine can be matched to find an acceptable interface. |
not | Empty element of the address exclusion type, used to constrain the selection criteria. |
point-to-point | Empty element indicating that part of the selection criteria for an interface should be whether or not it is a point-to-point interface. |
public-address | Empty element indicating that part of the selection criteria for an interface should be whether or not it has a publicly routable address. |
site-local-address | Empty element indicating that part of the selection criteria for an interface should be whether or not an address associated with it is site-local. |
subnet-match | A network IP address and the number of bits in the address' network prefix, written in "slash notation"; e.g. "192.168.0.0/16". |
up | Empty element indicating that part of the selection criteria for an interface should be whether or not it is currently up. |
virtual | Empty element indicating that part of the selection criteria for an interface should be whether or not it is a virtual interface. |
Configure Interface Attributes
Choose either the Management CLI or the Management Console to configure your interface attributes as required.Configure Interface Attributes with the Management CLI
Use the Management CLI to add new interfaces and write new values to the interface attributes.Add a New Interface
Use theadd
operation to create a new interface if required. You can run this command from the root of the Management CLI session, which in the following example creates a new interface name title interfacename, with aninet-address
declared as 12.0.0.2./interface=interfacename/:add(inet-address=12.0.0.2)
Edit Interface Attributes
Use thewrite
operation to write a new value to an attribute. you can use tab completion to help complete the command string as you type, as well as to expose the available attributes. The following example updates theinet-address
value to 12.0.0.8/interface=interfacename/:write(inet-address=12.0.0.8)
Edit Interface Attributes
Confirm the values are changed by running theread-resource
operation with theinclude-runtime=true
parameter to expose all current values active in the server model.[standalone@localhost:9999 interface=public]
:read-resource(include-runtime=true)
Configure Interface Attributes with the Management Console
Use the Management Console to add new interfaces and write new values to the interface attributes.Log into the Management Console.
Log into the Management Console of your Managed Domain or Standalone Server instance.If you use a Managed Domain, choose the correct profile.
Select the Profiles tab at the top right, and then select the correct profile from the Profile menu at the top left of the next screen.Select the Interfaces item from the navigation menu.
Select the Interfaces menu item from the navigation menu.Add a New Interface
- Click the Add button.
- Enter any required values for Name, Inet Address and Address Wildcard.
- Click the Save to finish.
Edit Interface Attributes
- Select the Interface to edit and click the Edit button.
- Enter any required values for Name, Inet Address and Address Wildcard.
- Click the Save to finish.
5.2. Socket Binding Groups
5.2.1. About Socket Binding Groups
domain.xml
and standalone.xml
configuration files. Other sections of the configuration can then reference those sockets by their logical name, rather than having to include the full details of the socket configuration. This allows you to reference relative socket configurations which may otherwise vary on different machines.
Example 5.6. Default socket bindings for the standalone configuration
standalone.xml
configuration file are grouped under standard-sockets
. This group is also referenced to the public
interface, using the same logical referencing methodology.
<socket-binding-group name="standard-sockets" default-interface="public"> <socket-binding name="http" port="8080"/> <socket-binding name="https" port="8443"/> <socket-binding name="jacorb" port="3528"/> <socket-binding name="jacorb-ssl" port="3529"/> <socket-binding name="jmx-connector-registry" port="1090" interface="management"/> <socket-binding name="jmx-connector-server" port="1091" interface="management"/> <socket-binding name="jndi" port="1099"/> <socket-binding name="messaging" port="5445"/> <socket-binding name="messaging-throughput" port="5455"/> <socket-binding name="osgi-http" port="8090" interface="management"/> <socket-binding name="remoting" port="4447"/> <socket-binding name="txn-recovery-environment" port="4712"/> <socket-binding name="txn-status-manager" port="4713"/> </socket-binding-group>
Example 5.7. Default socket bindings for the domain configuration
domain.xml
configuration file contain four groups: the standard-sockets
, ha-sockets
, full-sockets
and the full-ha-sockets
groups. These groups are also referenced to an interface called public
.
<socket-binding-groups> <socket-binding-group name="standard-sockets" default-interface="public"> <!-- Needed for server groups using the 'default' profile --> <socket-binding name="ajp" port="8009"/> <socket-binding name="http" port="8080"/> <socket-binding name="https" port="8443"/> <socket-binding name="osgi-http" interface="management" port="8090"/> <socket-binding name="remoting" port="4447"/> <socket-binding name="txn-recovery-environment" port="4712"/> <socket-binding name="txn-status-manager" port="4713"/> <outbound-socket-binding name="mail-smtp"> <remote-destination host="localhost" port="25"/> </outbound-socket-binding> </socket-binding-group> <socket-binding-group name="ha-sockets" default-interface="public"> <!-- Needed for server groups using the 'ha' profile --> <socket-binding name="ajp" port="8009"/> <socket-binding name="http" port="8080"/> <socket-binding name="https" port="8443"/> <socket-binding name="jgroups-mping" port="0" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45700"/> <socket-binding name="jgroups-tcp" port="7600"/> <socket-binding name="jgroups-tcp-fd" port="57600"/> <socket-binding name="jgroups-udp" port="55200" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45688"/> <socket-binding name="jgroups-udp-fd" port="54200"/> <socket-binding name="modcluster" port="0" multicast-address="224.0.1.105" multicast-port="23364"/> <socket-binding name="osgi-http" interface="management" port="8090"/> <socket-binding name="remoting" port="4447"/> <socket-binding name="txn-recovery-environment" port="4712"/> <socket-binding name="txn-status-manager" port="4713"/> <outbound-socket-binding name="mail-smtp"> <remote-destination host="localhost" port="25"/> </outbound-socket-binding> </socket-binding-group> <socket-binding-group name="full-sockets" default-interface="public"> <!-- Needed for server groups using the 'full' profile --> <socket-binding name="ajp" port="8009"/> <socket-binding name="http" port="8080"/> <socket-binding name="https" port="8443"/> <socket-binding name="jacorb" interface="unsecure" port="3528"/> <socket-binding name="jacorb-ssl" interface="unsecure" port="3529"/> <socket-binding name="messaging" port="5445"/> <socket-binding name="messaging-group" port="0" multicast-address="${jboss.messaging.group.address:231.7.7.7}" multicast-port="${jboss.messaging.group.port:9876}"/> <socket-binding name="messaging-throughput" port="5455"/> <socket-binding name="osgi-http" interface="management" port="8090"/> <socket-binding name="remoting" port="4447"/> <socket-binding name="txn-recovery-environment" port="4712"/> <socket-binding name="txn-status-manager" port="4713"/> <outbound-socket-binding name="mail-smtp"> <remote-destination host="localhost" port="25"/> </outbound-socket-binding> </socket-binding-group> <socket-binding-group name="full-ha-sockets" default-interface="public"> <!-- Needed for server groups using the 'full-ha' profile --> <socket-binding name="ajp" port="8009"/> <socket-binding name="http" port="8080"/> <socket-binding name="https" port="8443"/> <socket-binding name="jacorb" interface="unsecure" port="3528"/> <socket-binding name="jacorb-ssl" interface="unsecure" port="3529"/> <socket-binding name="jgroups-mping" port="0" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45700"/> <socket-binding name="jgroups-tcp" port="7600"/> <socket-binding name="jgroups-tcp-fd" port="57600"/> <socket-binding name="jgroups-udp" port="55200" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45688"/> <socket-binding name="jgroups-udp-fd" port="54200"/> <socket-binding name="messaging" port="5445"/> <socket-binding name="messaging-group" port="0" multicast-address="${jboss.messaging.group.address:231.7.7.7}" multicast-port="${jboss.messaging.group.port:9876}"/> <socket-binding name="messaging-throughput" port="5455"/> <socket-binding name="modcluster" port="0" multicast-address="224.0.1.105" multicast-port="23364"/> <socket-binding name="osgi-http" interface="management" port="8090"/> <socket-binding name="remoting" port="4447"/> <socket-binding name="txn-recovery-environment" port="4712"/> <socket-binding name="txn-status-manager" port="4713"/> <outbound-socket-binding name="mail-smtp"> <remote-destination host="localhost" port="25"/> </outbound-socket-binding> </socket-binding-group> </socket-binding-groups>
standalone.xml
and domain.xml
source files in the application server directory. The recommended method of managing bindings is to use either the Management Console or the Management CLI. The advantages of using the Management Console include a graphical user interface with a dedicated Socket Binding Group screen under the General Configuration section. The Management CLI offers an API and workflow based around a command line approach that allows for batch processing and the use of scripts across the higher and lower levels of the application server configuration. Both interfaces allow for changes to be persisted or otherwise saved to the server configuration.
5.2.2. Configure Socket Bindings
standard-sockets
group, and is unable to create any further groups. Instead you can create alternate Standalone Server configuration files. For the Managed Domain however, you can create multiple socket binding groups and configure the socket bindings that they contain as you require. The following table shows the available attributes for each socket binding.
Table 5.2. Socket Binding Attributes
Component | Description | Role |
---|---|---|
Name | Logical name of the socket configuration that should be used elsewhere in the configuration. | Required |
Port | Base port to which a socket based on this configuration should be bound. Note that servers can be configured to override this base value by applying an increment or decrement to all port values. | Required |
Interface | Logical name of the interface to which a socket based on this configuration should be bound. If not defined, the value of the "default-interface" attribute from the enclosing socket binding group will be used. | Optional |
Multicast Address | If the socket will be used for multicast, the multicast address to use. | Optional |
Multicast Port | Bound to the lifecycle of the conversation. The conversation scope is between the lengths of the request and the session, and is controlled by the application. | Optional |
Fixed Port | If the above contexts do not meet your needs, you can define custom scopes. | Optional |
Configure Socket Bindings in Socket Binding Groups
Choose either the Management CLI or the Management Console to configure your socket bindings as required.Configure Socket Bindings Using the Management CLI
Use the Management CLI to configure socket bindings.Add a New Socket Binding
Use theadd
operation to create a new address setting if required. You can run this command from the root of the Management CLI session, which in the following examples creates a new socket binding titled newsocket, with aport
attribute declared as 1234. The examples apply for both Standalone Server and a Managed Domain editing on thestandard-sockets
socket binding group as shown.[domain@localhost:9999 /] /socket-binding-group=standard-sockets/socket-binding=newsocket/:add(port=1234)
Edit Pattern Attributes
Use thewrite
operation to write a new value to an attribute. You can use tab completion to help complete the command string as you type, as well as to expose the available attributes. The following example updates theport
value to 2020[domain@localhost:9999 /] /socket-binding-group=standard-sockets/socket-binding=newsocket/:write-attribute(name=port,value=2020)
Confirm Pattern Attributes
Confirm the values are changed by running theread-resource
operation with theinclude-runtime=true
parameter to expose all current values active in the server model.[domain@localhost:9999 /] /socket-binding-group=standard-sockets/socket-binding=newsocket/:read-resource
Configure Socket Bindings Using the Management Console
Use the Management Console to configure socket bindings.Log into the Management Console.
Log into the Management Console of your Managed Domain or Standalone Server.Select the Profile tab
Select the Profiles tab at the top right.Select the Socket Binding item from the navigation menu.
Select the Socket Binding menu item from the navigation menu. If you are using a Managed Domain, select the desired group in the Socket Binding Groups menu.Add a New Socket Binding
- Click the Add button.
- Enter any required values for Name, Port and Binding Group.
- Click the Save to finish.
Edit Interface Attributes
- Select the Socket Binding to edit and click the Edit button.
- Enter any required values such as Name, Interface or Port.
- Click the Save to finish.
5.2.3. Network Ports Used By JBoss EAP 6
- Whether your server groups use one of the default socket binding groups, or a custom group.
- The requirements of your individual deployments.
Note
The default socket binding groups
full-ha-sockets
full-sockets
ha-sockets
standard-sockets
Table 5.3. Reference of the default socket bindings
Name | Port | Mulicast Port | Description | full-ha-sockets | full-sockets | ha-socket | standard-socket |
---|---|---|---|---|---|---|---|
ajp | 8009 | Apache JServ Protocol. Used for HTTP clustering and load balancing. | Yes | Yes | Yes | Yes | |
http | 8080 | The default port for deployed web applications. | Yes | Yes | Yes | Yes | |
https | 8443 | SSL-encrypted connection between deployed web applications and clients. | Yes | Yes | Yes | Yes | |
jacorb | 3528 | CORBA services for JTS transactions and other ORB-dependent services. | Yes | Yes | No | No | |
jacorb-ssl | 3529 | SSL-encrypted CORBA services. | Yes | Yes | No | No | |
jgroups-diagnostics | 7500 | Multicast. Used for peer discovery in HA clusters. Not configurable using the Management Interfaces. | Yes | No | Yes | No | |
jgroups-mping | 45700 | Multicast. Used to discover initial membership in a HA cluster. | Yes | No | Yes | No | |
jgroups-tcp | 7600 | Unicast peer discovery in HA clusters using TCP. | Yes | No | Yes | No | |
jgroups-tcp-fd | 57600 | Used for HA failure detection over TCP. | Yes | No | Yes | No | |
jgroups-udp | 55200 | 45688 | Unicast peer discovery in HA clusters using UDP. | Yes | No | Yes | No |
jgroups-udp-fd | 54200 | Used for HA failure detection over UDP. | Yes | No | Yes | No | |
messaging | 5445 | JMS service. | Yes | Yes | No | No | |
messaging-group | Referenced by HornetQ JMS broadcast and discovery groups. | Yes | Yes | No | No | ||
messaging-throughput | 5455 | Used by JMS Remoting. | Yes | Yes | No | No | |
mod_cluster | 23364 | Multicast port for communication between JBoss EAP 6 and the HTTP load balancer. | Yes | No | Yes | No | |
osgi-http | 8090 | Used by internal components which use the OSGi subsystem. Not configurable using the Management Interfaces. | Yes | Yes | Yes | Yes | |
remoting | 4447 | Used for remote EJB invocation. | Yes | Yes | Yes | Yes | |
txn-recovery-environment | 4712 | The JTA transaction recovery manager. | Yes | Yes | Yes | Yes | |
txn-status-manager | 4713 | The JTA / JTS transation manager. | Yes | Yes | Yes | Yes |
In addition to the socket binding groups, each host controller opens two more ports for management purposes:
- 9990 - The Web Management Console port
- 9999 - The port used by the Management Console and Management API
5.2.4. About Port Offsets for Socket Binding Groups
5.2.5. Configure Port Offsets
Configure Port Offsets
Choose either the Management CLI or the Management Console to configure your port offsets.Configure Port Offsets Using the Management CLI
Use the Management CLI to configure port offsets.Edit Port Offsets
Use thewrite
operation to write a new value to the port offset atttribute. The following example updates thesocket-binding-port-offset
value of server-two to 250. This server is a member of the default local host group. A restart is required for the changes to take affect.[domain@localhost:9999 /] /host=master/server-config=server-two/:write-attribute(name=socket-binding-port-offset,value=250)
Confirm Port Offset Attributes
Confirm the values are changed by running theread-resource
operation with theinclude-runtime=true
parameter to expose all current values active in the server model.[domain@localhost:9999 /] /host=master/server-config=server-two/:read-resource(include-runtime=true)
Configure Port Offsets Using the Management Console
Use the Management Console to configure port offsets.Log into the Management Console.
Log into the Management Console of your Managed Domain.Select the Hosts tab
Select the Hosts tab at the top right.Edit Port Offset Attributes
- Select the server under the
Configuration Name
section and click the Edit button. - Enter any desired values in the Port Offset field.
- Click the Save button to finish.
5.3. IPv6
5.3.1. Configure JVM Stack Preferences for IPv6 Networking
- Summary
- This topic covers enabling IPv6 networking for the JBoss EAP 6 installation.
Procedure 5.1. Disable the IPv4 Stack Java Property
- Open the relevant file for the installation:
For a Standalone Server:
OpenEAP_HOME/bin/standalone.conf
.For a Managed Domain:
OpenEAP_HOME/bin/domain.conf
.
- Change the IPv4 Stack Java property to false:
-Djava.net.preferIPv4Stack=false
For example:# Specify options to pass to the Java VM. # if [ "x$JAVA_OPTS" = "x" ]; then JAVA_OPTS="-Xms64m -Xmx512m -XX:MaxPermSize=256m -Djava.net.preferIPv4Stack=false -Dorg.jboss.resolver.warning=true -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000 -Djava.net.preferIPv6Addresses=true" fi
5.3.2. Configure the Interface Declarations for IPv6 Networking
Follow these steps to configure the interface inet address to the IPv6 default:
Procedure 5.2. Configure the Interface for IPv6 Networking
- Select the Profile tab, in the top right corner of the console.
- Select the Interfaces option under General Configuration.
- Select the named network interface to configure.
- Click the Edit button.
- Set the inet address to:
${jboss.bind.address.management:[ADDRESS]}
- Click the Save button to save the changes.
- Restart the server to implement the changes.
5.3.3. Configure JVM Stack Preferences for IPv6 Addresses
- Summary
- This topic covers configuring the JBoss EAP 6 installation to prefer IPv6 addresses through the configuration files.
Procedure 5.3. Configure the JBoss EAP 6 Installation to Prefer IPv6 Addresses
- Open the relevant file for the installation:
For a Standalone Server:
OpenEAP_HOME/bin/standalone.conf
.For a Managed Domain:
OpenEAP_HOME/bin/domain.conf
.
- Append the following Java property to the Java VM options:
-Djava.net.preferIPv6Addresses=true
For example:# Specify options to pass to the Java VM. # if [ "x$JAVA_OPTS" = "x" ]; then JAVA_OPTS="-Xms64m -Xmx512m -XX:MaxPermSize=256m -Djava.net.preferIPv4Stack=false -Dorg.jboss.resolver.warning=true -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000 -Djava.net.preferIPv6Addresses=true" fi
Chapter 6. Datasource Management
6.1. Introduction
6.1.1. About JDBC
6.1.2. JBoss EAP 6 Supported Databases
6.1.3. Types of Datasources
datasources
and XA datasources
.
6.1.4. The Example Datasource
Warning
6.1.5. Deployment of -ds.xml files
*-ds.xml
datasource configuration file was required in the deployment directory of the server configuration. *-ds.xml
files can still be deployed in JBoss EAP 6, following the schema available here: http://docs.jboss.org/ironjacamar/schema/datasources_1_1.xsd.
Warning
Important
*-ds.xml
files.
6.2. JDBC Drivers
6.2.1. Install a JDBC Driver with the Management Console
Before your application can connect to a JDBC datasource, your datasource vendor's JDBC drivers need to be installed in a location where JBoss EAP 6 can use them. JBoss EAP 6 allows you to deploy these drivers just like any other deployment. This means that you can deploy them across multiple servers in a server group, if you use a managed domain.
Note
Before performing this task, you need to meet the following prerequisites:
- Download the JDBC driver from your database vendor.
Procedure 6.1. Deploy the JDBC Driver
Access the Management Console.
Deploy the JAR file to your server or server group.
If you use a managed domain, deploy the JAR file to a server group. Otherwise, deploy it to your server. See Section 9.2.2, “Deploy an Application Using the Management Console”.
The JDBC driver is deployed, and is available for your applications to use.
6.2.2. Install a JDBC Driver as a Core Module
Before performing this task, you need to meet the following prerequisites:
- Download the JDBC driver from your database vendor. JDBC driver download locations are listed here: Section 6.2.3, “JDBC Driver Download Locations”.
- Extract the archive.
Procedure 6.2. Install a JDBC Driver as a Core Module
- Create a file path structure under the
EAP_HOME/modules/
directory. For example, for a MySQL JDBC driver, create a directory structure as follows:EAP_HOME/modules/com/mysql/main/
. - Copy the JDBC driver JAR into the
main/
subdirectory. - In the
main/
subdirectory, create amodule.xml
file similar to the example in Section 7.1.1, “Modules”. Themodule
XSD is defined in theEAP_HOME/docs/schema/module-1_2.xsd
file. - Start the Server.
- Start the Management CLI.
- Run the following CLI command to add the JDBC driver module as a driver:
/subsystem=datasources/jdbc-driver=DRIVER_NAME:add(driver-name=DRIVER_NAME,driver-module-name=MODULE_NAME,driver-xa-datasource-class-name=XA_DATASOURCE_CLASS_NAME)
Example 6.1. Example CLI Command
/subsystem=datasources/jdbc-driver=mysql:add(driver-name=mysql,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc2.optional.MysqlXADataSource)
The JDBC driver is now installed and set up as a core module, and is available to be referenced by application datasources.
6.2.3. JDBC Driver Download Locations
Table 6.1. JDBC driver download locations
Vendor | Download Location |
---|---|
MySQL | |
PostgreSQL | |
Oracle | |
IBM | |
Sybase | |
Microsoft |
6.2.4. Access Vendor Specific Classes
This topic covers the steps required to use the JDBC specific classes. This is necessary when an application needs to use vendor specific functionality that is not part of the JDBC API.
Warning
Important
Important
Prerequisites
Procedure 6.3. Add a Dependency to the Application
Configure the
MANIFEST.MF
file- Open the application's
META-INF/MANIFEST.MF
file in a text editor. - Add a dependency for the JDBC module and save the file.
Dependencies: MODULE_NAME
Example 6.2. Example Dependency
Dependencies: com.mysql
Create a
jboss-deployment-structure.xml
fileCreate a file calledjboss-deployment-structure.xml
in theMETA-INF/
orWEB-INF
folder of the application.Example 6.3. Example
jboss-deployment-structure.xml
file<jboss-deployment-structure> <deployment> <dependencies> <module name="com.mysql" /> </dependencies> </deployment> </jboss-deployment-structure>
Example 6.4. Access the Vendor Specific API
import java.sql.Connection; import org.jboss.jca.adapters.jdbc.WrappedConnection; Connection c = ds.getConnection(); WrappedConnection wc = (WrappedConnection)c; com.mysql.jdbc.Connection mc = wc.getUnderlyingConnection();
6.3. Non-XA Datasources
6.3.1. Create a Non-XA Datasource with the Management Interfaces
This topic covers the steps required to create a non-XA datasource, using either the Management Console or the Management CLI.
Prerequisites
- The JBoss EAP 6 server must be running.
Note
Procedure 6.4. Create a Datasource using either the Management CLI or the Management Console
Management CLI
- Launch the CLI tool and connect to your server.
- Run the following command to create a non-XA datasource, configuring the variables as appropriate:
data-source add --name=DATASOURCE_NAME --jndi-name=JNDI_NAME --driver-name=DRIVER_NAME --connection-url=CONNECTION_URL
- Enable the datasource:
data-source enable --name=DATASOURCE_NAME
Management Console
- Login to the Management Console.
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.1. Datasources panel
Create a new datasource
- Select the Add button at the top of the Datasources panel.
- Enter the new datasource attributes in the Create Datasource wizard and proceed with the Next button.
- Enter the JDBC driver details in the Create Datasource wizard and proceed with the Next button.
- Enter the connection settings in the Create Datasource wizard and select the Done button.
The non-XA datasource has been added to the server. It is now visible in either the standalone.xml
or domain.xml
file, as well as the management interfaces.
6.3.2. Modify a Non-XA Datasource with the Management Interfaces
This topic covers the steps required to modify a non-XA datasource, using either the Management Console or the Management CLI.
Prerequisites
Note
jta
parameter is set to true
.
Procedure 6.5. Modify a Non-XA Datasource
Management CLI
- Use the
write-attribute
command to configure a datasource attribute:/subsystem=datasources/data-source=DATASOURCE_NAME:write-attribute(name=ATTRIBUTE_NAME,value=ATTRIBUTE_VALUE)
- Reload the server to confirm the changes:
:reload
Management Console
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.2. Datasources panel
Edit the datasource
- Select the relevant datasource from the Available Datasources list. The datasource attributes are displayed in the Attributes panel below it.
- Select the Edit button to edit the datasource attributes.
- Edit the datasource attributes and select the Save button when done.
The non-XA datasource has been configured. The changes are now visible in either the standalone.xml
or domain.xml
file, as well as the management interfaces.
- To create a new datasource, refer here: Section 6.3.1, “Create a Non-XA Datasource with the Management Interfaces”.
- To remove the datasource, refer here: Section 6.3.3, “Remove a Non-XA Datasource with the Management Interfaces”.
6.3.3. Remove a Non-XA Datasource with the Management Interfaces
This topic covers the steps required to remove a non-XA datasource from JBoss EAP 6, using either the Management Console or the Management CLI.
Prerequisites
Procedure 6.6. Remove a Non-XA Datasource
Management CLI
- Run the following command to remove a non-XA datasource:
data-source remove --name=DATASOURCE_NAME
Management Console
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.3. Datasources panel
- Select the registered datasource to be deleted, and click the Remove button in the top right corner of the console.
The non-XA datasource has been removed from the server.
- To add a new datasource, refer here: Section 6.3.1, “Create a Non-XA Datasource with the Management Interfaces”.
6.4. XA Datasources
6.4.1. Create an XA Datasource with the Management Interfaces
This topic covers the steps required to create an XA datasource, using either the Management Console or the Management CLI.
Prerequisites
Note
Procedure 6.7. Create an XA Datasource, Using Either the Management CLI or the Management Console
Management CLI
- Run the following command to create an XA datasource, configuring the variables as appropriate:
xa-data-source add --name=XA_DATASOURCE_NAME --jndi-name=JNDI_NAME --driver-name=DRIVER_NAME --xa-datasource-class=XA_DATASOURCE_CLASS
Configure the XA datasource properties
Set the server name
Run the following command to configure the server name for the host:/subsystem=datasources/xa-data-source=XA_DATASOURCE_NAME/xa-datasource-properties=ServerName:add(value=HOSTNAME)
Set the database name
Run the following command to configure the database name:/subsystem=datasources/xa-data-source=XA_DATASOURCE_NAME/xa-datasource-properties=DatabaseName:add(value=DATABASE_NAME)
- Enable the datasource:
xa-data-source enable --name=XA_DATASOURCE_NAME
Management Console
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.4. Datasources panel
- Select the XA Datasource panel.
Create a new XA datasource
- Select the Add button at the top of the XA Datasources panel.
- Enter the new XA datasource attributes in the Create XA Datasource wizard and proceed with the Next button.
- Enter the JDBC driver details in the Create XA Datasource wizard and proceed with the Next button.
- Edit the XA properties and proceed with the Next button.
- Enter the connection settings in the Create XA Datasource wizard and select the Done button.
The XA datasource has been added to the server. It is now visible in either the standalone.xml
or domain.xml
file, as well as the management interfaces.
- To configure the datasource further, refer here: Section 6.4.2, “Modify an XA Datasource with the Management Interfaces”.
- To remove the datasource, refer here: Section 6.4.3, “Remove an XA Datasource with the Management Interfaces”.
6.4.2. Modify an XA Datasource with the Management Interfaces
This topic covers the steps required to modify an XA datasource, using either the Management Console or the Management CLI.
Prerequisites
Procedure 6.8. Modify an XA Datasource, Using Either the Management CLI or the Management Console
Management CLI
Configure XA datasource attributes
Use thewrite-attribute
command to configure a datasource attribute:/subsystem=datasources/xa-data-source=XA_DATASOURCE_NAME:write-attribute(name=ATTRIBUTE_NAME,value=ATTRIBUTE_VALUE)
Configure XA datasource properties
Run the following command to configure an XA datasource subresource:/subsystem=datasources/xa-data-source=DATASOURCE_NAME/xa-datasource-properties=PROPERTY_NAME:add(value=PROPERTY_VALUE)
- Reload the server to confirm the changes:
:reload
Management Console
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.5. Datasources panel
- Select the XA Datasource panel.
Edit the datasource
- Select the relevant XA datasource from the Available XA Datasources list. The XA datasource attributes are displayed in the Attributes panel below it.
- Select the Edit button to edit the datasource attributes.
- Edit the XA datasource attributes and select the Save button when done.
The XA datasource has been configured. The changes are now visible in either the standalone.xml
or domain.xml
file, as well as the management interfaces.
- To create a new datasource, refer here: Section 6.4.1, “Create an XA Datasource with the Management Interfaces”.
- To remove the datasource, refer here: Section 6.4.3, “Remove an XA Datasource with the Management Interfaces”.
6.4.3. Remove an XA Datasource with the Management Interfaces
This topic covers the steps required to remove an XA datasource from JBoss EAP 6, using either the Management Console or the Management CLI.
Prerequisites
Procedure 6.9. Remove an XA Datasource Using Either the Management CLI or the Management Console
Management CLI
- Run the following command to remove an XA datasource:
xa-data-source remove --name=XA_DATASOURCE_NAME
Management Console
Navigate to the Datasources panel in the Management Console
Standalone Mode
Select the Profile tab from the top-right of the console.Domain Mode
- Select the Profiles tab from the top-right of the console.
- Select the appropriate profile from the drop-down box in the top left.
- Expand the Subsystems menu on the left of the console.
- Select Connector → Datasources from the menu on the left of the console.
Figure 6.6. Datasources panel
- Select the XA Datasource panel.
- Select the registered XA datasource to be deleted, and click the Remove button in the top right corner of the console.
The XA datasource has been removed from the server.
- To add a new XA datasource, refer here: Section 6.4.1, “Create an XA Datasource with the Management Interfaces”.
6.4.4. XA Recovery
6.4.4.1. About XA Recovery Modules
com.arjuna.ats.jta.recovery.XAResourceRecovery
.
6.4.4.2. Configure XA Recovery Modules
Table 6.2. General Configuration Attributes
Attribute | Description |
---|---|
recovery-username |
The username the recovery module should use to connect to the resource for recovery.
|
recovery-password |
The password the recovery module should use to connect to the resource for recovery.
|
recovery-security-domain |
The security domain the recovery module should use to connect to the resource for recovery.
|
recovery-plugin-class-name |
If you need to use a custom recovery module, set this attribute to the fully-qualified class name of the module. The module should extend class
com.arjuna.ats.jta.recovery.XAResourceRecovery .
|
recovery-plugin-properties |
If you use a custom recovery module which requires properties to be set, set this attribute to the list of comma-separated key=value pairs for the properties.
|
Vendor-Specific Configuration Information
- Oracle
- If the Oracle datasource is configured incorrectly, you may see errors like the following in your log output:
WARN [com.arjuna.ats.jta.logging.loggerI18N] [com.arjuna.ats.internal.jta.recovery.xarecovery1] Local XARecoveryModule.xaRecovery got XA exception javax.transaction.xa.XAException, XAException.XAER_RMERR
To resolve this error, ensure that the Oracle user configured inrecovery-username
has access to the tables needed for recovery. The following SQL statement shows the correct grants for Oracle 11g or Oracle 10g R2 instances patched for Oracle bug 5945463.GRANT SELECT ON sys.dba_pending_transactions TO recovery-username; GRANT SELECT ON sys.pending_trans$ TO recovery-username; GRANT SELECT ON sys.dba_2pc_pending TO recovery-username; GRANT EXECUTE ON sys.dbms_xa TO recovery-username;
If you use an Oracle 11 version prior to 11g, change the finalEXECUTE
statement to the following:GRANT EXECUTE ON sys.dbms_system TO recovery-username;
- PostgreSQL
- See the PostgreSQL documentation for instructions on enabling prepared (i.e. XA) transactions. Version 8.4-701 of PostgreSQL's JDBC driver has a bug in
org.postgresql.xa.PGXAConnection
which breaks recovery in certain situations. This is fixed in newer versions. - MySQL
- Based on http://bugs.mysql.com/bug.php?id=12161, XA transaction recovery did not work in some versions of MySQL 5. This is addressed in MySQL 6.1. Refer to the bug URL or to the MySQL documentation for more information.
- IBM DB2
- IBM DB2 expects method
XAResource.recover
to be called only during the designated resynchronization stage which occurs when the application server is restarted after a crash or failure. This is a design decision in the DB2 implementation, and out of the scope of this documentation.
6.5. Datasource Security
6.5.1. About Datasource Security
- Security domains: Section 10.6.1, “About Security Domains”.
- Password vaults: Section 10.12.1, “About Securing Sensitive Strings in Clear-Text Files”.
Example 6.5. Security Domain Example
<security> <security-domain>mySecurityDomain</security-domain> </security>
Example 6.6. Password Vault Example
<security> <user-name>admin</user-name> <password>${VAULT::ds_ExampleDS::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}</password> </security>
6.6. Datasource Configuration
6.6.1. Datasource Parameters
Table 6.3. Datasource parameters common to non-XA and XA datasources
Parameter | Description |
---|---|
jndi-name | The unique JNDI name for the datasource. |
pool-name | The name of the management pool for the datasource. |
enabled | Whether or not the datasource is enabled. |
use-java-context |
Whether to bind the datasource to global JNDI.
|
spy |
Enable
spy functionality on the JDBC layer. This logs all JDBC traffic to the datasource. The logging-category parameter must also be set to org.jboss.jdbc .
|
use-ccm | Enable the cached connection manager. |
new-connection-sql | A SQL statement which executes when the connection is added to the connection pool. |
transaction-isolation |
One of the following:
|
url-delimiter | The delimiter for URLs in a connection-url for High Availability (HA) clustered databases. |
url-selector-strategy-class-name | A class that implements interface org.jboss.jca.adapters.jdbc.URLSelectorStrategy . |
security |
Contains child elements which are security settings. Refer to Table 6.8, “Security parameters”.
|
validation |
Contains child elements which are validation settings. Refer to Table 6.9, “Validation parameters”.
|
timeout |
Contains child elements which are timeout settings. Refer to Table 6.10, “Timeout parameters”.
|
statement |
Contains child elements which are statement settings. Refer to Table 6.11, “Statement parameters”.
|
Table 6.4. Non-XA datasource parameters
Parameter | Description |
---|---|
jta | Enable JTA integration for non-XA datasources. Does not apply to XA datasources. |
connection-url | The JDBC driver connection URL. |
driver-class | The fully-qualified name of the JDBC driver class. |
connection-property |
Arbitrary connection properties passed to the method
Driver.connect(url,props) . Each connection-property specifies a string name/value pair. The property name comes from the name, and the value comes from the element content.
|
pool |
Contains child elements which are pooling settings. Refer to Table 6.6, “Pool parameters common to non-XA and XA datasources”.
|
Table 6.5. XA datasource parameters
Parameter | Description |
---|---|
xa-datasource-property |
A property to assign to implementation class
XADataSource . Specified by name=value. If a setter method exists, in the format setName , the property is set by calling a setter method in the format of setName(value) .
|
xa-datasource-class |
The fully-qualified name of the implementation class
javax.sql.XADataSource .
|
driver |
A unique reference to the classloader module which contains the JDBC driver. The accepted format is driverName#majorVersion.minorVersion.
|
xa-pool |
Contains child elements which are pooling settings. Refer to Table 6.6, “Pool parameters common to non-XA and XA datasources” and Table 6.7, “XA pool parameters”.
|
recovery |
Contains child elements which are recovery settings. Refer to Table 6.12, “Recovery parameters”.
|
Table 6.6. Pool parameters common to non-XA and XA datasources
Parameter | Description |
---|---|
min-pool-size | The minimum number of connections a pool holds. |
max-pool-size | The maximum number of connections a pool can hold. |
prefill | Whether to try to prefill the connection pool. An empty element denotes a true value. The default is false . |
use-strict-min | Whether the pool-size is strict. Defaults to false . |
flush-strategy |
Whether the pool should be flushed in the case of an error. Valid values are:
The default is
FailingConnectionOnly .
|
allow-multiple-users | Specifies if multiple users will access the datasource through the getConnection(user, password) method, and whether the internal pool type should account for this behavior. |
Table 6.7. XA pool parameters
Parameter | Description |
---|---|
is-same-rm-override | Whether the javax.transaction.xa.XAResource.isSameRM(XAResource) class returns true or false . |
interleaving | Whether to enable interleaving for XA connection factories. |
no-tx-separate-pools | Whether to create separate sub-pools for each context. This is required for Oracle datasources, which do not allow XA connections to be used both inside and outside of a JTA transaction. |
pad-xid | Whether to pad the Xid. |
wrap-xa-resource |
Whether to wrap the XAResource in an
org.jboss.tm.XAResourceWrapper instance.
|
Table 6.8. Security parameters
Parameter | Description |
---|---|
user-name | The username to use to create a new connection. |
password | The password to use to create a new connection. |
security-domain | Contains the name of a JAAS security-manager which handles authentication. This name correlates to the application-policy/name attribute of the JAAS login configuration. |
reauth-plugin | Defines a reauthentication plugin to use to reauthenticate physical connections. |
Table 6.9. Validation parameters
Parameter | Description |
---|---|
valid-connection-checker |
An implementation of interface
org.jboss.jca.adaptors.jdbc.ValidConnectionChecker which provides a SQLException.isValidConnection(Connection e) method to validate a connection. An exception means the connection is destroyed. This overrides the parameter check-valid-connection-sql if it is present.
|
check-valid-connection-sql | An SQL statement to check validity of a pool connection. This may be called when a managed connection is taken from a pool for use. |
validate-on-match |
Indicates whether connection level validation is performed when a connection factory attempts to match a managed connection for a given set.
Specifying "true" for
validate-on-match is typically not done in conjunction with specifying "true" for background-validation . Validate-on-match is needed when a client must have a connection validated prior to use. This parameter is true by default.
|
background-validation |
Specifies that connections are validated on a background thread. Background validation is a performance optimization when not used with
validate-on-match . If validate-on-match is true, using background-validation could result in redundant checks. Background validation does leave open the opportunity for a bad connection to be given to the client for use (a connection goes bad between the time of the validation scan and prior to being handed to the client), so the client application must account for this possibility.
|
background-validation-millis | The amount of time, in milliseconds, that background validation runs. |
use-fast-fail |
If true, fail a connection allocation on the first attempt, if the connection is invalid. Defaults to
false .
|
stale-connection-checker |
An instance of
org.jboss.jca.adapters.jdbc.StaleConnectionChecker which provides a Boolean isStaleConnection(SQLException e) method. If this method returns true , the exception is wrapped in an org.jboss.jca.adapters.jdbc.StaleConnectionException , which is a subclass of SQLException .
|
exception-sorter |
An instance of
org.jboss.jca.adapters.jdbc.ExceptionSorter which provides a Boolean isExceptionFatal(SQLException e) method. This method validates whether an exception should be broadcast to all instances of javax.resource.spi.ConnectionEventListener as a connectionErrorOccurred message.
|
Table 6.10. Timeout parameters
Parameter | Description |
---|---|
use-try-lock | Uses tryLock() instead of lock() . This attempts to obtain the lock for the configured number of seconds, before timing out, rather than failing immediately if the lock is unavailable. Defaults to 60 seconds. As an example, to set a timeout of 5 minutes, set <use-try-lock> 300</use-try-lock> . |
blocking-timeout-millis | The maximum time, in milliseconds, to block while waiting for a connection. After this time is exceeded, an exception is thrown. This blocks only while waiting for a permit for a connection, and does not throw an exception if creating a new connection takes a long time. Defaults to 30000, which is 30 seconds. |
idle-timeout-minutes |
The maximum time, in minutes, before an idle connection is closed. The actual maximum time depends upon the idleRemover scan time, which is half of the smallest
idle-timeout-minutes of any pool.
|
set-tx-query-timeout |
Whether to set the query timeout based on the time remaining until transaction timeout. Any configured query timeout is used if no transaction exists. Defaults to
false .
|
query-timeout | Timeout for queries, in seconds. The default is no timeout. |
allocation-retry | The number of times to retry allocating a connection before throwing an exception. The default is 0 , so an exception is thrown upon the first failure. |
allocation-retry-wait-millis |
How long, in milliseconds, to wait before retrying to allocate a connection. The default is 5000, which is 5 seconds.
|
xa-resource-timeout |
If non-zero, this value is passed to method
XAResource.setTransactionTimeout .
|
Table 6.11. Statement parameters
Parameter | Description |
---|---|
track-statements |
Whether to check for unclosed statements when a connection is returned to a pool and a statement is returned to the prepared statement cache. If false, statements are not tracked.
Valid values
|
prepared-statement-cache-size | The number of prepared statements per connection, in a Least Recently Used (LRU) cache. |
share-prepared-statements |
Whether asking for the same statement twice without closing it uses the same underlying prepared statement. The default is
false .
|
Table 6.12. Recovery parameters
Parameter | Description |
---|---|
recover-credential | A username/password pair or security domain to use for recovery. |
recover-plugin |
An implementation of the
org.jboss.jca.core.spi.recoveryRecoveryPlugin class, to be used for recovery.
|
6.6.2. Datasource Connection URLs
Table 6.13.
Datasource | Connection URL |
---|---|
PostgreSQL | jdbc:postgresql://SERVER_NAME:PORT/DATABASE_NAME |
MySQL | jdbc:mysql://SERVER_NAME:PORT/DATABASE_NAME |
Oracle | jdbc:oracle:thin:@ORACLE_HOST:PORT:ORACLE_SID |
IBM DB2 | jdbc:db2://SERVER_NAME:PORT/DATABASE_NAME |
Microsoft SQLServer | jdbc:microsoft:sqlserver://SERVER_NAME:PORT;DatabaseName=DATABASE_NAME |
6.6.3. Datasource Extensions
Table 6.14. Datasource Extensions
Datasource Extension | Configuration Parameter | Description |
---|---|---|
org.jboss.jca.adapters.jdbc.spi.ExceptionSorter | <exception-sorter> | Checks whether an SQLException is fatal for the connection on which it was thrown |
org.jboss.jca.adapters.jdbc.spi.StaleConnection | <stale-connection-checker> | Wraps stale SQLExceptions in a org.jboss.jca.adapters.jdbc.StaleConnectionException |
org.jboss.jca.adapters.jdbc.spi.ValidConnection | <valid-connection-checker> | Checks whether a connection is valid for use by the application |
Extension Implementations
- Generic
- org.jboss.jca.adapters.jdbc.extensions.novendor.NullExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.novendor.NullStaleConnectionChecker
- org.jboss.jca.adapters.jdbc.extensions.novendor.NullValidConnectionChecker
- org.jboss.jca.adapters.jdbc.extensions.novendor.JDBC4ValidConnectionChecker
- PostgreSQL
- org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLValidConnectionChecker
- MySQL
- org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLReplicationValidConnectionChecker
- org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker
- IBM DB2
- org.jboss.jca.adapters.jdbc.extensions.db2.DB2ExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.db2.DB2StaleConnectionChecker
- org.jboss.jca.adapters.jdbc.extensions.db2.DB2ValidConnectionChecker
- Sybase
- org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseValidConnectionChecker
- Microsoft SQLServer
- org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker
- Oracle
- org.jboss.jca.adapters.jdbc.extensions.oracle.OracleExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.oracle.OracleExceptionSorter
- org.jboss.jca.adapters.jdbc.extensions.oracle.OracleValidConnectionChecker
6.6.4. View Datasource Statistics
jdbc
and pool
using appropriately modified versions of the commands below:
Procedure 6.10.
/subsystem=datasources/data-source=ExampleDS/statistics=jdbc:read-resource(include-runtime=true)
/subsystem=datasources/data-source=ExampleDS/statistics=pool:read-resource(include-runtime=true)
Note
include-runtime=true
argument, as all statistics are runtime only information and the default is false
.
6.6.5. Datasource Statistics
The following table contains a list of the supported datasource core statistics:
Table 6.15. Core Statistics
Name | Description |
---|---|
ActiveCount |
The number of active connections. Each of the connections is either in use by an application or available in the pool
|
AvailableCount |
The number of available connections in the pool.
|
AverageBlockingTime |
The average time spent blocking on obtaining an exclusive lock on the pool. The value is in milliseconds.
|
AverageCreationTime |
The average time spent creating a connection. The value is in milliseconds.
|
CreatedCount |
The number of connections created.
|
DestroyedCount |
The number of connections destroyed.
|
InUseCount |
The number of connections currently in use.
|
MaxCreationTime |
The maximum time it took to create a connection. The value is in milliseconds.
|
MaxUsedCount |
The maximum number of connections used.
|
MaxWaitCount |
The maximum number of requests waiting for a connection at the same time.
|
MaxWaitTime |
The maximum time spent waiting for an exclusive lock on the pool.
|
TimedOut |
The number of timed out connections.
|
TotalBlockingTime |
The total time spent waiting for an exclusive lock on the pool. The value is in milliseconds.
|
TotalCreationTime |
The total time spent creating connections. The value is in milliseconds.
|
WaitCount |
The number of requests that had to wait for a connection.
|
The following table contains a list of the supported datasource JDBC statistics:
Table 6.16. JDBC Statistics
Name | Description |
---|---|
PreparedStatementCacheAccessCount |
The number of times that the statement cache was accessed.
|
PreparedStatementCacheAddCount |
The number of statements added to the statement cache.
|
PreparedStatementCacheCurrentSize |
The number of prepared and callable statements currently cached in the statement cache.
|
PreparedStatementCacheDeleteCount |
The number of statements discarded from the cache.
|
PreparedStatementCacheHitCount |
The number of times that statements from the cache were used.
|
PreparedStatementCacheMissCount |
The number of times that a statement request could not be satisfied with a statement from the cache.
|
6.7. Example Datasources
6.7.1. Example PostgreSQL Datasource
Example 6.7.
<datasources> <datasource jndi-name="java:jboss/PostgresDS" pool-name="PostgresDS"> <connection-url>jdbc:postgresql://localhost:5432/postgresdb</connection-url> <driver>postgresql</driver> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLValidConnectionChecker"></valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLExceptionSorter"></exception-sorter> </validation> </datasource> <drivers> <driver name="postgresql" module="org.postgresql"> <xa-datasource-class>org.postgresql.xa.PGXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the PostgreSQL datasource above.
<module xmlns="urn:jboss:module:1.1" name="org.postgresql"> <resources> <resource-root path="postgresql-9.1-902.jdbc4.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.2. Example PostgreSQL XA Datasource
Example 6.8.
<datasources> <xa-datasource jndi-name="java:jboss/PostgresXADS" pool-name="PostgresXADS"> <driver>postgresql</driver> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="PortNumber">5432</xa-datasource-property> <xa-datasource-property name="DatabaseName">postgresdb</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLValidConnectionChecker"> </valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.postgres.PostgreSQLExceptionSorter"> </exception-sorter> </validation> </xa-datasource> <drivers> <driver name="postgresql" module="org.postgresql"> <xa-datasource-class>org.postgresql.xa.PGXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the PostgreSQL XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="org.postgresql"> <resources> <resource-root path="postgresql-9.1-902.jdbc4.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.3. Example MySQL Datasource
Example 6.9.
<datasources> <datasource jndi-name="java:jboss/MySqlDS" pool-name="MySqlDS"> <connection-url>jdbc:mysql://mysql-localhost:3306/jbossdb</connection-url> <driver>mysql</driver> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"></valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter"></exception-sorter> </validation> </datasource> <drivers> <driver name="mysql" module="com.mysql"> <xa-datasource-class>com.mysql.jdbc.jdbc2.optional.MysqlXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the MySQL datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.mysql"> <resources> <resource-root path="mysql-connector-java-5.0.8-bin.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.4. Example MySQL XA Datasource
Example 6.10.
<datasources> <xa-datasource jndi-name="java:jboss/MysqlXADS" pool-name="MysqlXADS"> <driver>mysql</driver> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">mysqldb</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"></valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter"></exception-sorter> </validation> </xa-datasource> <drivers> <driver name="mysql" module="com.mysql"> <xa-datasource-class>com.mysql.jdbc.jdbc2.optional.MysqlXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the MySQL XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.mysql"> <resources> <resource-root path="mysql-connector-java-5.0.8-bin.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.5. Example Oracle Datasource
Note
Example 6.11.
<datasources> <datasource jndi-name="java:/OracleDS" pool-name="OracleDS"> <connection-url>jdbc:oracle:thin:@localhost:1521:XE</connection-url> <driver>oracle</driver> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleValidConnectionChecker"></valid-connection-checker> <stale-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleStaleConnectionChecker"></stale-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleExceptionSorter"></exception-sorter> </validation> </datasource> <drivers> <driver name="oracle" module="com.oracle"> <xa-datasource-class>oracle.jdbc.xa.client.OracleXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the Oracle datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.oracle"> <resources> <resource-root path="ojdbc6.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.6. Example Oracle XA Datasource
Note
Important
user
is the user defined to connect from JBoss to Oracle:
- GRANT SELECT ON sys.dba_pending_transactions TO user;
- GRANT SELECT ON sys.pending_trans$ TO user;
- GRANT SELECT ON sys.dba_2pc_pending TO user;
- GRANT EXECUTE ON sys.dbms_xa TO user; (If using Oracle 10g R2 (patched) or Oracle 11g)ORGRANT EXECUTE ON sys.dbms_system TO user; (If using an unpatched Oracle version prior to 11g)
Example 6.12.
<datasources> <xa-datasource jndi-name="java:/XAOracleDS" pool-name="XAOracleDS"> <driver>oracle</driver> <xa-datasource-property name="URL">jdbc:oracle:oci8:@tc</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <xa-pool> <is-same-rm-override>false</is-same-rm-override> <no-tx-separate-pools /> </xa-pool> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleValidConnectionChecker"></valid-connection-checker> <stale-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleStaleConnectionChecker"></stale-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.oracle.OracleExceptionSorter"></exception-sorter> </validation> </xa-datasource> <drivers> <driver name="oracle" module="com.oracle"> <xa-datasource-class>oracle.jdbc.xa.client.OracleXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the Oracle XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.oracle"> <resources> <resource-root path="ojdbc6.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.7. Example Microsoft SQLServer Datasource
Example 6.13.
<datasources> <datasource jndi-name="java:/MSSQLDS" pool-name="MSSQLDS"> <connection-url>jdbc:microsoft:sqlserver://localhost:1433;DatabaseName=MyDatabase</connection-url> <driver>sqlserver</driver> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"></valid-connection-checker> </validation> </datasource> <drivers> <driver name="sqlserver" module="com.microsoft"> <xa-datasource-class>com.microsoft.sqlserver.jdbc.SQLServerXADataSource</xa-datasource-class> </driver> </datasources>
module.xml
file for the Microsoft SQLServer datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.microsoft"> <resources> <resource-root path="sqljdbc4.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.8. Example Microsoft SQLServer XA Datasource
Example 6.14.
<datasources> <xa-datasource jndi-name="java:/MSSQLXADS" pool-name="MSSQLXADS"> <driver>sqlserver</driver> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">mssqldb</xa-datasource-property> <xa-datasource-property name="SelectMethod">cursor</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <xa-pool> <is-same-rm-override>false</is-same-rm-override> </xa-pool> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"></valid-connection-checker> </validation> </xa-datasource> <drivers> <driver name="sqlserver" module="com.microsoft"> <xa-datasource-class>com.microsoft.sqlserver.jdbc.SQLServerXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the Microsoft SQLServer XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.microsoft"> <resources> <resource-root path="sqljdbc4.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.9. Example IBM DB2 Datasource
Example 6.15.
<datasources> <datasource jndi-name="java:/DB2DS" pool-name="DB2DS"> <connection-url>jdbc:db2:ibmdb2db</connection-url> <driver>ibmdb2</driver> <pool> <min-pool-size>0</min-pool-size> <max-pool-size>50</max-pool-size> </pool> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2ValidConnectionChecker"></valid-connection-checker> <stale-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2StaleConnectionChecker"></stale-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2ExceptionSorter"></exception-sorter> </validation> </datasource> <drivers> <driver name="ibmdb2" module="com.ibm"> <xa-datasource-class>com.ibm.db2.jdbc.DB2XADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the IBM DB2 datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.ibm"> <resources> <resource-root path="db2jcc.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.10. Example IBM DB2 XA Datasource
Example 6.16.
<datasources> <xa-datasource jndi-name="java:/DB2XADS" pool-name="DB2XADS"> <driver>ibmdb2</driver> <xa-datasource-property name="DatabaseName">ibmdb2db</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <xa-pool> <is-same-rm-override>false</is-same-rm-override> </xa-pool> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2ValidConnectionChecker"></valid-connection-checker> <stale-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2StaleConnectionChecker"></stale-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.db2.DB2ExceptionSorter"></exception-sorter> </validation> <recovery> <recovery-plugin class-name="org.jboss.jca.core.recovery.ConfigurableRecoveryPlugin"> <config-property name="EnableIsValid">false</config-property> <config-property name="IsValidOverride">false</config-property> <config-property name="EnableClose">false</config-property> </recovery-plugin> </recovery> </xa-datasource> <drivers> <driver name="ibmdb2" module="com.ibm"> <xa-datasource-class>com.ibm.db2.jcc.DB2XADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the IBM DB2 XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.ibm"> <resources> <resource-root path="db2jcc.jar"/> <resource-root path="db2jcc_license_cisuz.jar"/> <resource-root path="db2jcc_license_cu.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.11. Example Sybase Datasource
Example 6.17.
<datasources> <datasource jndi-name="java:jboss/SybaseDB" pool-name="SybaseDB" enabled="true"> <connection-url>jdbc:sybase:Tds:localhost:5000/DATABASE?JCONNECT_VERSION=6</connection-url> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseValidConnectionChecker"></valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseExceptionSorter"></exception-sorter> </validation> </datasource> <drivers> <driver name="sybase" module="com.sybase"> <datasource-class>com.sybase.jdbc2.jdbc.SybDataSource</datasource-class> <xa-datasource-class>com.sybase.jdbc3.jdbc.SybXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the Sybase datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.sybase"> <resources> <resource-root path="jconn2.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
6.7.12. Example Sybase XA Datasource
Example 6.18.
<datasources> <xa-datasource jndi-name="java:jboss/SybaseXADS" pool-name="SybaseXADS" enabled="true"> <xa-datasource-property name="NetworkProtocol">Tds</xa-datasource-property> <xa-datasource-property name="ServerName">myserver</xa-datasource-property> <xa-datasource-property name="PortNumber">4100</xa-datasource-property> <xa-datasource-property name="DatabaseName">mydatabase</xa-datasource-property> <security> <user-name>admin</user-name> <password>admin</password> </security> <validation> <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseValidConnectionChecker"></valid-connection-checker> <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.sybase.SybaseExceptionSorter"></exception-sorter> </validation> </xa-datasource> <drivers> <driver name="sybase" module="com.sybase"> <datasource-class>com.sybase.jdbc2.jdbc.SybDataSource</datasource-class> <xa-datasource-class>com.sybase.jdbc3.jdbc.SybXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
module.xml
file for the Sybase XA datasource above.
<module xmlns="urn:jboss:module:1.1" name="com.sybase"> <resources> <resource-root path="jconn2.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
Chapter 7. Configuring Modules
7.1. Introduction
7.1.1. Modules
- Static Modules
- Static Modules are predefined in the
EAP_HOME/modules/
directory of the application server. Each sub-directory represents one module and contains one or more JAR files and a configuration file (module.xml
). The name of the module is defined in themodule.xml
file. All the application server provided APIs are provided as static modules, including the Java EE APIs as well as other APIs such as JBoss Logging.Example 7.1. Example module.xml file
<?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.0" name="com.mysql"> <resources> <resource-root path="mysql-connector-java-5.1.15.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
The module name,com.mysql
, should match the directory structure for the module.Creating custom static modules can be useful if many applications are deployed on the same server that use the same third party libraries. Instead of bundling those libraries with each application, a module containing these libraries can be created and installed by the JBoss administrator. The applications can then declare an explicit dependency on the custom static modules. - Dynamic Modules
- Dynamic Modules are created and loaded by the application server for each JAR or WAR deployment (or subdeployment in an EAR). The name of a dynamic module is derived from the name of the deployed archive. Because deployments are loaded as modules, they can configure dependencies and be used as dependencies by other deployments.
7.1.2. Global Modules
7.1.3. Module Dependencies
Example 7.2. Module dependencies
- Module A declares an explicit dependency on Module C, or
- Module B exports its dependency on Module C.
7.1.4. Subdeployment Class Loader Isolation
7.2. Disable Subdeployment Module Isolation for All Deployments
Warning
Stop the server
Halt the JBoss EAP server.Open the server configuration file
Open the server configuration file in a text editor.This file will be different for a managed domain or standalone server. In addition, non-default locations and file names may be used. The default configuration files aredomain/configuration/domain.xml
andstandalone/configuration/standalone.xml
for managed domains and standalone servers respectively.Locate the EE Subsystem Configuration
Locate the EE Subsystem configuration element in the configuration file. The<profile>
element of the configuration file contains several subsystem elements. The EE Subsystem element has the namespace ofurn:jboss:domain:ee:1.0
.<profile> ... <subsystem xmlns="urn:jboss:domain:ee:1.0" /> ...
The default configuration has a single self-closing tag but a custom configuration may have separate open and closing tags (possibly with other elements within) like this:<subsystem xmlns="urn:jboss:domain:ee:1.0" ></subsystem>
Replace self-closing tags if necessary
If the EE Subsystem element is a single self-closing tag then replace with appropriate opening and closing tags like this:<subsystem xmlns="urn:jboss:domain:ee:1.0" ></subsystem>
Add ear-subdeployments-isolated element
Add theear-subdeployments-isolated
element as a child of the EE Subsystem element and add the content offalse
like this:<subsystem xmlns="urn:jboss:domain:ee:1.0" ><ear-subdeployments-isolated>false</ear-subdeployments-isolated></subsystem>
Start the server
Relaunch the JBoss EAP server to start it running with the new configuration.
The server will now be running with Subdeployment Module Isolation disabled for all deployments.
7.3. Add a module to all deployments
Prerequisites
- You must know the name of the modules that are to be configured as global modules. Refer to Section 7.4.1, “Included Modules” for the list of static modules included with JBoss EAP 6. If the module is in another deployment, refer to Section 7.4.2, “Dynamic Module Naming” to determine the module name.
Procedure 7.1. Add a module to the list of global modules
- Login to the management console. Section 3.4.2, “Log in to the Management Console”
- Navigate to the EE Subsystem panel.
Figure 7.1. EE Subsystem Panel
- Click the Add button in the Global Modules section. The Create Module dialog appears.
- Type in the name of the module and optionally the module slot.
- Click the Save button to add the new global module, or click the Cancel link to abort.
- If you click the Save button, the dialog will close and the specified module will be added to the list of global modules.
- If you click Cancel, the dialog will close and no changes will be made.
The modules added to the list of global modules will be added as dependencies to every deployment.
7.4. Reference
7.4.1. Included Modules
asm.asm
ch.qos.cal10n
com.google.guava
com.h2database.h2
com.sun.jsf-impl
com.sun.jsf-impl
com.sun.xml.bind
com.sun.xml.messaging.saaj
gnu.getopt
javaee.api
javax.activation.api
javax.annotation.api
javax.api
javax.ejb.api
javax.el.api
javax.enterprise.api
javax.enterprise.deploy.api
javax.faces.api
javax.faces.api
javax.inject.api
javax.interceptor.api
javax.jms.api
javax.jws.api
javax.mail.api
javax.management.j2ee.api
javax.persistence.api
javax.resource.api
javax.rmi.api
javax.security.auth.message.api
javax.security.jacc.api
javax.servlet.api
javax.servlet.jsp.api
javax.servlet.jstl.api
javax.transaction.api
javax.validation.api
javax.ws.rs.api
javax.wsdl4j.api
javax.xml.bind.api
javax.xml.jaxp-provider
javax.xml.registry.api
javax.xml.rpc.api
javax.xml.soap.api
javax.xml.stream.api
javax.xml.ws.api
jline
net.sourceforge.cssparser
net.sourceforge.htmlunit
net.sourceforge.nekohtml
nu.xom
org.antlr
org.apache.ant
org.apache.commons.beanutils
org.apache.commons.cli
org.apache.commons.codec
org.apache.commons.collections
org.apache.commons.io
org.apache.commons.lang
org.apache.commons.logging
org.apache.commons.pool
org.apache.cxf
org.apache.httpcomponents
org.apache.james.mime4j
org.apache.log4j
org.apache.neethi
org.apache.santuario.xmlsec
org.apache.velocity
org.apache.ws.scout
org.apache.ws.security
org.apache.ws.xmlschema
org.apache.xalan
org.apache.xerces
org.apache.xml-resolver
org.codehaus.jackson.jackson-core-asl
org.codehaus.jackson.jackson-jaxrs
org.codehaus.jackson.jackson-mapper-asl
org.codehaus.jackson.jackson-xc
org.codehaus.woodstox
org.dom4j
org.hibernate
org.hibernate.envers
org.hibernate.infinispan
org.hibernate.validator
org.hornetq
org.hornetq.ra
org.infinispan
org.infinispan.cachestore.jdbc
org.infinispan.cachestore.remote
org.infinispan.client.hotrod
org.jacorb
org.javassist
org.jaxen
org.jboss.as.aggregate
org.jboss.as.appclient
org.jboss.as.cli
org.jboss.as.clustering.api
org.jboss.as.clustering.common
org.jboss.as.clustering.ejb3.infinispan
org.jboss.as.clustering.impl
org.jboss.as.clustering.infinispan
org.jboss.as.clustering.jgroups
org.jboss.as.clustering.service
org.jboss.as.clustering.singleton
org.jboss.as.clustering.web.infinispan
org.jboss.as.clustering.web.spi
org.jboss.as.cmp
org.jboss.as.connector
org.jboss.as.console
org.jboss.as.controller
org.jboss.as.controller-client
org.jboss.as.deployment-repository
org.jboss.as.deployment-scanner
org.jboss.as.domain-add-user
org.jboss.as.domain-http-error-context
org.jboss.as.domain-http-interface
org.jboss.as.domain-management
org.jboss.as.ee
org.jboss.as.ee.deployment
org.jboss.as.ejb3
org.jboss.as.embedded
org.jboss.as.host-controller
org.jboss.as.jacorb
org.jboss.as.jaxr
org.jboss.as.jaxrs
org.jboss.as.jdr
org.jboss.as.jmx
org.jboss.as.jpa
org.jboss.as.jpa.hibernate
org.jboss.as.jpa.hibernate
org.jboss.as.jpa.hibernate.infinispan
org.jboss.as.jpa.openjpa
org.jboss.as.jpa.spi
org.jboss.as.jpa.util
org.jboss.as.jsr77
org.jboss.as.logging
org.jboss.as.mail
org.jboss.as.management-client-content
org.jboss.as.messaging
org.jboss.as.modcluster
org.jboss.as.naming
org.jboss.as.network
org.jboss.as.osgi
org.jboss.as.platform-mbean
org.jboss.as.pojo
org.jboss.as.process-controller
org.jboss.as.protocol
org.jboss.as.remoting
org.jboss.as.sar
org.jboss.as.security
org.jboss.as.server
org.jboss.as.standalone
org.jboss.as.threads
org.jboss.as.transactions
org.jboss.as.web
org.jboss.as.webservices
org.jboss.as.webservices.server.integration
org.jboss.as.webservices.server.jaxrpc-integration
org.jboss.as.weld
org.jboss.as.xts
org.jboss.classfilewriter
org.jboss.com.sun.httpserver
org.jboss.common-core
org.jboss.dmr
org.jboss.ejb-client
org.jboss.ejb3
org.jboss.iiop-client
org.jboss.integration.ext-content
org.jboss.interceptor
org.jboss.interceptor.spi
org.jboss.invocation
org.jboss.ironjacamar.api
org.jboss.ironjacamar.impl
org.jboss.ironjacamar.jdbcadapters
org.jboss.jandex
org.jboss.jaxbintros
org.jboss.jboss-transaction-spi
org.jboss.jsfunit.core
org.jboss.jts
org.jboss.jts.integration
org.jboss.logging
org.jboss.logmanager
org.jboss.logmanager.log4j
org.jboss.marshalling
org.jboss.marshalling.river
org.jboss.metadata
org.jboss.modules
org.jboss.msc
org.jboss.netty
org.jboss.osgi.deployment
org.jboss.osgi.framework
org.jboss.osgi.resolver
org.jboss.osgi.spi
org.jboss.osgi.vfs
org.jboss.remoting3
org.jboss.resteasy.resteasy-atom-provider
org.jboss.resteasy.resteasy-cdi
org.jboss.resteasy.resteasy-jackson-provider
org.jboss.resteasy.resteasy-jaxb-provider
org.jboss.resteasy.resteasy-jaxrs
org.jboss.resteasy.resteasy-jsapi
org.jboss.resteasy.resteasy-multipart-provider
org.jboss.sasl
org.jboss.security.negotiation
org.jboss.security.xacml
org.jboss.shrinkwrap.core
org.jboss.staxmapper
org.jboss.stdio
org.jboss.threads
org.jboss.vfs
org.jboss.weld.api
org.jboss.weld.core
org.jboss.weld.spi
org.jboss.ws.api
org.jboss.ws.common
org.jboss.ws.cxf.jbossws-cxf-client
org.jboss.ws.cxf.jbossws-cxf-factories
org.jboss.ws.cxf.jbossws-cxf-server
org.jboss.ws.cxf.jbossws-cxf-transports-httpserver
org.jboss.ws.jaxws-client
org.jboss.ws.jaxws-jboss-httpserver-httpspi
org.jboss.ws.native.jbossws-native-core
org.jboss.ws.native.jbossws-native-factories
org.jboss.ws.native.jbossws-native-services
org.jboss.ws.saaj-impl
org.jboss.ws.spi
org.jboss.ws.tools.common
org.jboss.ws.tools.wsconsume
org.jboss.ws.tools.wsprovide
org.jboss.xb
org.jboss.xnio
org.jboss.xnio.nio
org.jboss.xts
org.jdom
org.jgroups
org.joda.time
org.junit
org.omg.api
org.osgi.core
org.picketbox
org.picketlink
org.python.jython.standalone
org.scannotation.scannotation
org.slf4j
org.slf4j.ext
org.slf4j.impl
org.slf4j.jcl-over-slf4j
org.w3c.css.sac
sun.jdk
7.4.2. Dynamic Module Naming
- Deployments of WAR and JAR files are named with the following format:
deployment.DEPLOYMENT_NAME
For example,inventory.war
andstore.jar
will have the module names ofdeployment.inventory.war
anddeployment.store.jar
respectively. - Subdeployments within an Enterprise Archive are named with the following format:
deployment.EAR_NAME.SUBDEPLOYMENT_NAME
For example, the subdeployment ofreports.war
within the enterprise archiveaccounts.ear
will have the module name ofdeployment.accounts.ear.reports.war
.
Chapter 8. Global Valves
8.1. About Valves
8.2. About Global Valves
8.3. About Authenticator Valves
org.apache.catalina.authenticator.AuthenticatorBase
and overrides the authenticate()
method.
8.4. Install a Global Valve
Pre-requisities:
- The valve must already be created and packaged in a JAR file.
- A
module.xml
file must already be created for the module.Refer to Section 7.1.1, “Modules” for an example ofmodule.xml
file.
Procedure 8.1. Install a Global Module
Create module installation directory
A directory for the module to be installed in must be created in the modules directory of the application server.EAP_HOME/modules/system/layers/base/MODULENAME/main
$ mkdir -P /usr/share/jboss/modules/system/layers/base/MyValveModule/main
Copy files
Copy the JAR andmodule.xml
files to the directory created in step 1.$ cp MyValves.jar modules.xml /usr/share/jboss/modules/system/layers/base/MyValveModule/main
8.5. Configure a Global Valve
Procedure 8.2. Configure a Global Valve
Enable the Valve
Use theadd
operation to add a new valve entry./subsystem=web/valve=VALVENAME:add(module="MODULENAME",class-name="CLASSNAME")
You need to specify the following values:VALVENAME
, the name that is used to refer to this valve in application configuration.MODULENAME
, the module that contains the value being configured.CLASSNAME
, the classname of the specific valve in the module.
/subsystem=web/valve=clientlimiter:add(module="clientlimitermodule",class-name="org.jboss.samplevalves.restrictedUserAgentsValve")
Optionally: Specify Parameters
If the valve has configuration parameters, specify these with theadd-param
operation./subsystem=web/valve=testvalve:add-param(param-name="NAME", param-value="VALUE")
/subsystem=web/valve=testvalve:add-param( param-name="restricteduseragents", param-value="^.*MS Web Services Client Protocol.*$" )
Chapter 9. Application Deployment
9.1. About Application Deployment
Administration
Management CLI
Development
Deployment Scanner
9.2. Deploy with the Management Console
9.2.1. Manage Application Deployment in the Management Console
9.2.2. Deploy an Application Using the Management Console
Prerequisites
Procedure 9.1. Deploy an Application using the Management Console
Navigate to the Manage Deployments panel in the Management Console
- Select the Runtime tab from the top right of the console.
- Select the Deployments → Manage Deployments option from the menu on the left of the console.
Deploy an application
The deployment method will differ depending on whether you are deploying to a standalone server instance or a managed domain.Deploy to a standalone server instance
The Deployments table shows all available application deployments and their status.Figure 9.1. Available deployments
Enable the application in a standalone server instance
Click on the Enable button in the Deployments table to enable the application deployment.Confirm
Click on the confirm button to confirm that the application will be enabled on the server instance.Figure 9.2. Available deployments in a standalone server
Deploy to a managed domain
The Deployment Content section contains a Content Repository table showing all available application deployments and their status.Figure 9.3. Available deployments in a managed domain
Enable the application in a Managed Domain
Click on the Add to Groups button in the Content Repository table.Select server groups
Check the boxes for each of the server groups that you want the application to be added to and click on the Save button to continue.Figure 9.4. Select server groups for application deployment
Confirm
Click on the Server Group Deployments tab to view the Server Groups table. Your application is now deployed to the server groups that you have selected.Figure 9.5. Confirmation of application deployment to server groups
The application is deployed on the relevant server or server group.
9.2.3. Undeploy an Application Using the Management Console
Prerequisites
Procedure 9.2. Undeploy an Application using the Management Console
Navigate to the Manage Deployments panel in the Management Console
- Select the Runtime tab from the top right of the console.
- Select the Deployments → Manage Deployments option from the menu on the left of the console.
Undeploy an application
The undeployment method will differ depending on whether you are deploying to a standalone server instance or a managed domain.Undeploy from a standalone server instance
The Deployments table shows all available application deployments and their status.Figure 9.6. Available deployments
Disable the application in a standalone server instance
Click on the Disable button in the Deployments table to disable the application.Confirm that you wish to disable the application
Click on the confirm button to confirm that the application will be disabled on the server instance.Figure 9.7. Confirm the application to disable
Undeploy from a managed domain
The Deployment Content section contains a Content Repository table showing all available application deployments and their status.Figure 9.8. Available deployments in a managed domain
Disable the application in a Managed Domain
Click on the Server Group Deployments tab to view the server groups and the status of their deployed applications.Figure 9.9. Server group deployments
Select server group
Click on the name of the server in the Server Group table to undeploy an application from.Disable the application from the selected server
Click on the disable button to disable the application for the selected server.Confirm that you wish to disable the application
Click on the confirm button to confirm that the application will be disabled on the server instance.Figure 9.10. Confirm the application to disable
Repeat undeployment for remaining server groups
Repeat as required for other server groups. The application status is confirmed for each server group in the Deployments table.Figure 9.11. Confirmation of application undeployment from a server group
The application is undeployed from the relevant server or server group.
9.3. Deploy with the Management CLI
9.3.1. Manage Application Deployment in the Management CLI
9.3.2. Deploy an Application in a Managed Domain Using the Management CLI
Prerequisites
Procedure 9.3. Deploy an Application in a Managed Domain
Run the
deploy
commandFrom the Management CLI, enter thedeploy
command with the path to the application deployment. Include the--all-server-groups
parameter to deploy to all server groups.[domain@localhost:9999 /]
deploy /path/to/test-application.war --all-server-groups
- Alternatively, define specific server groups for the deployment with the
--server-groups
parameter.[domain@localhost:9999 /]
deploy /path/to/test-application.war --server-groups=server_group_1,server_group_2
Note that a successful deploy does not produce any output to the CLI.
The specified application is now deployed to a server group in your managed domain.
9.3.3. Undeploy an Application in a Managed Domain Using the Management CLI
Prerequisites
Procedure 9.4. Undeploy an Application in a Managed Domain
Run the
undeploy
commandFrom the Management CLI, enter theundeploy
command with the filename of the application deployment. The application can be undeployed from any server group that it was originally deployed to with the addition of the--all-relevant-server-groups
parameter.[domain@localhost:9999 /]
undeploy
test-application.war--all-relevant-server-groups
Note that a successful undeploy does not produce any output to the CLI.
The specified application is now undeployed.
9.3.4. Deploy an Application in a Standalone Server Using the Management CLI
Prerequisites
Procedure 9.5. Deploy an Application in a Standalone Server
Run the
deploy
commandFrom the Management CLI, enter thedeploy
command with the path to the application deployment.[standalone@localhost:9999 /]
deploy /path/to/test-application.war
Note that a successful deploy does not produce any output to the CLI.
The specified application is now deployed in the standalone server.
9.3.5. Undeploy an Application in a Standalone Server Using the Management CLI
Prerequisites
Procedure 9.6. Undeploy an Application in a Standalone Server
Run the
undeploy
commandFrom the Management CLI, enter theundeploy
command with the filename of the application deployment.[standalone@localhost:9999 /]
undeploy test-application.war
Note that a successful undeploy does not produce any output to the CLI.
The specified application is now undeployed.
9.4. Deploy with the Deployment Scanner
9.4.1. Manage Application Deployment in the Deployment Scanner
9.4.2. Deploy an Application to a Standalone Server Instance with the Deployment Scanner
Prerequisites
This task shows a method for deploying applications to a standalone server instance with the deployment scanner. As indicated in the Section 9.1, “About Application Deployment” topic, this method is retained for the convenience of developers, where the Management Console and Management CLI methods are recommended for application management under production environments.
Procedure 9.7. Use the Deployment Scanner to Deploy Applications
Copy content to the deployment folder
Copy the application file to the deployment folder found atEAP_HOME/standalone/deployments/
.Deployment scanning modes
The application deployment varies between automatic and manual deployment scanner modes.Automatic deployment
The deployment scanner picks up a change to the state of the folder and creates a marker file as defined in the Section 9.4.5, “Reference for Deployment Scanner Marker Files” topic.Manual deployment
The deployment scanner requires a marker file to trigger the deployment process. The following example uses the Unixtouch
command to create a new.dodeploy
file.Example 9.1. Deploy with the
touch
command[user@host bin]$
touch
$EAP_HOME/standalone/deployments/example.war.dodeploy
The application file is deployed to the application server. A marker file is created in the deployment folder to indicate the successful deployment, and the application is flagged as Enabled
in the Management Console.
Example 9.2. Deployment folder contents after deployment
example.war example.war.deployed
9.4.3. Undeploy an Application to a Standalone Server Instance with the Deployment Scanner
Prerequisites
This task shows a method for undeploying applications from a standalone server instance that have been deployed with the deployment scanner. As indicated in the Section 9.1, “About Application Deployment” topic, this method is retained for the convenience of developers, where the Management Console and Management CLI methods are recommended for application management under production environments.
Note
Procedure 9.8. Undeploy an Application using one of these Methods
Undeploy the application
There are two methods to undeploy the application depending on whether you want to delete the application from the deployment folder or only alter its deployment status.Undeploy by deleting the marker file
Delete the deployed application'sexample.war.deployed
marker file to trigger the deployment scanner to begin undeploying the application from the runtime.- Result
- The deployment scanner undeploys the application and creates a
example.war.undeployed
marker file. The application remains in the deployment folder.
Undeploy by removing the application
Remove the application from the deployment directory to trigger the deployment scanner to begin undeploying the application from the runtime.- Result
- The deployment scanner undeploys the application and creates a
filename.filetype.undeployed
marker file. The application is not present in the deployment folder.
The application file is undeployed from the application server and is not visible in the Deployments screen of the Management Console.
9.4.4. Redeploy an Application to a Standalone Server Instance with the Deployment Scanner
Prerequisites
This task shows a method for redeploying applications to a standalone server instance that have been deployed with the deployment scanner. As indicated in the Section 9.1, “About Application Deployment” topic, this method is retained for the convenience of developers, where the Management Console and Management CLI methods are recommended for application management under production environments.
Procedure 9.9. Redeploy an Application to a Standalone Server
Redeploy the application
There are three possible methods to redeploy an application deployed with the deployment scanner. These methods trigger the deployment scanner to initiate a deployment cycle, and can be chosen to suit personal preference.Redeploy by altering the marker file
Trigger the deployment scanner redeployment by altering the marker file's access and modification timestamp. In the following Linux example, a Unixtouch
command is used.Example 9.3. Redeploy with the Unix
touch
command[user@host bin]$
touch
EAP_HOME/standalone/deployments/example.war.dodeployResultThe deployment scanner detects a change in the marker file and redeploys the application. A new
.deployed
file marker replaces the previous.Redeploy by creating a new
.dodeploy
marker fileTrigger the deployment scanner redeployment by creating a new.dodeploy
marker file. Refer to the manual deployment instructions in Section 9.4.2, “Deploy an Application to a Standalone Server Instance with the Deployment Scanner”.Redeploy by deleting the marker file
As described in Section 9.4.5, “Reference for Deployment Scanner Marker Files”, deleting a deployed application's.deployed
marker file will trigger an undeployment and create an.undeployed
marker. Deleting the undeployment marker will trigger the deployment cycle again. Refer to Section 9.4.3, “Undeploy an Application to a Standalone Server Instance with the Deployment Scanner” for further information.
The application file is redeployed.
9.4.5. Reference for Deployment Scanner Marker Files
Marker files are a part of the deployment scanner subsystem. These files mark the status of an application within the deployment directory of the standalone server instance. A marker file has the same name as the application, with the file suffix indicating the state of the application's deployment. The following table defines the types and responses for each marker file.
Example 9.4. Marker file example
testapplication.war
.
testapplication.war.deployed
Table 9.1. Marker filetype definitions
Filename Suffix | Origin | Description |
---|---|---|
.dodeploy | User generated | Indicates that the content should be deployed or redeployed into the runtime. |
.skipdeploy | User generated | Disables auto-deploy of an application while present. Useful as a method of temporarily blocking the auto-deployment of exploded content, preventing the risk of incomplete content edits pushing live. Can be used with zipped content, although the scanner detects in-progress changes to zipped content and waits until completion. |
.isdeploying | System generated | Indicates the initiation of deployment. The marker file will be deleted when the deployment process completes. |
.deployed | System generated | Indicates that the content has been deployed. The content will be undeployed if this file is deleted. |
.failed | System generated | Indicates deployment failure. The marker file contains information about the cause of failure. If the marker file is deleted, the content will be visible to the auto-deployment again. |
.isundeploying | System generated | Indicates a response to a .deployed file deletion. The content will be undeployed and the marker will be automatically deleted upon completion. |
.undeployed | System generated | Indicates that the content has been undeployed. Deletion of the marker file has no impact to content redeployment. |
.pending | System generated | Indicates that deployment instructions will be sent to the server pending resolution of a detected issue. This marker serves as a global deployment road-block. The scanner will not instruct the server to deploy or undeploy any other content while this condition exists. |
9.4.6. Reference for Deployment Scanner Attributes
write-attribute
operation. For more information on configuration options, refer to the topic Section 9.4.8, “Configure the Deployment Scanner with the Management CLI”.
Table 9.2. Deployment Scanner Attributes
Name | Description | Type | default Value |
---|---|---|---|
auto-deploy-exploded | Allows the automatic deployment of exploded content without requiring a .dodeploy marker file. Recommended for only basic development scenarios to prevent exploded application deployment from occurring during changes by the developer or operating system. | Boolean | False |
auto-deploy-xml | Allows the automatic deployment of XML content without requiring a .dodeploy marker file. | Boolean | True |
auto-deploy-zipped | Allows the automatic deployment of zipped content without requiring a .dodeploy marker file. | Boolean | True |
deployment-timeout | The time value in seconds for the deployment scanner to allow a deployment attempt before being cancelled. | Long | 60 |
path | Defines the actual filesystem path to be scanned. If the relative-to attribute is specified, the path value acts as a relative addition to that directory or path. | String | Deployments |
relative-to | Reference to a filesystem path defined in the paths section of the server configuration XML file. | String | jboss.server.base.dir |
scan-enabled | Allows the automatic scanning for applications by scan-interval and at startup. | Boolean | True |
scan-interval | The time interval in milliseconds between scans of the repository. A value of less than 1 restricts the scanner to operate only at startup. | Int | 5000 |
9.4.7. Configure the Deployment Scanner
9.4.8. Configure the Deployment Scanner with the Management CLI
Prerequisites
While there are multiple methods of configuring the deployment scanner, the Management CLI can be used to expose and modify the attributes by use of batch scripts or in real time. You can modify the behavior of the deployment scanner by use of the read-attribute
and write-attribute
global command line operations. Further information about the deployment scanner attributes are defined in the topic Section 9.4.6, “Reference for Deployment Scanner Attributes”.
standalone.xml
.
<subsystem xmlns="urn:jboss:domain:deployment-scanner:1.1"> <deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000"/> </subsystem>
Procedure 9.10. Configure the Deployment Scanner
Determine the deployment scanner attributes to configure
Configuring the deployment scanner via the Management CLI requires that you first expose the correct attribute names. You can do this with theread-resources
operation at either the root node, or by using thecd
command to change into the subsystem child node. You can also display the attributes with thels
command at this level.Expose the deployment scanner attributes with the
read-resource
operationUse theread-resource
operation to expose the attributes defined by the default deployment scanner resource.[standalone@localhost:9999 /]/subsystem=deployment-scanner/scanner=default:read-resource { "outcome" => "success", "result" => { "auto-deploy-exploded" => false, "auto-deploy-xml" => true, "auto-deploy-zipped" => true, "deployment-timeout" => 60, "path" => "deployments", "relative-to" => "jboss.server.base.dir", "scan-enabled" => true, "scan-interval" => 5000 } }
Expose the deployment scanner attributes with the
ls
commandUse thels
command with the-l
optional argument to display a table of results that include the subsystem node attributes, values, and type. You can learn more about thels
command and its arguments by exposing the CLI help entry by typingls --help
. For more information about the help menu in the Management CLI, refer to the topic Section 3.5.5, “Get Help with the Management CLI”.[standalone@localhost:9999 /] ls -l /subsystem=deployment-scanner/scanner=default ATTRIBUTE VALUE TYPE auto-deploy-exploded false BOOLEAN auto-deploy-xml true BOOLEAN auto-deploy-zipped true BOOLEAN deployment-timeout 60 LONG path deployments STRING relative-to jboss.server.base.dir STRING scan-enabled true BOOLEAN scan-interval 5000 INT
Configure the deployment scanner with the
write-attribute
operationOnce you have determined the name of the attribute to modify, use thewrite-attribute
to specify the attribute name and the new value to write to it. The following examples are all run at the child node level, which can be accessed by using thecd
command and tab completion to expose and change into the default scanner node.[standalone@localhost:9999 /] cd subsystem=deployment-scanner/scanner=default
Enable automatic deployment of exploded content
Use thewrite-attribute
operation to enable the automatic deployment of exploded application content.[standalone@localhost:9999 scanner=default] :write-attribute(name=auto-deploy-exploded,value=true) {"outcome" => "success"}
Disable the automatic deployment of XML content
Use thewrite-attribute
operation to disable the automatic deployment of XML application content.[standalone@localhost:9999 scanner=default] :write-attribute(name=auto-deploy-xml,value=false) {"outcome" => "success"}
Disable the automatic deployment of zipped content
Use thewrite-attribute
command to disable the automatic deployment of zipped application content.[standalone@localhost:9999 scanner=default] :write-attribute(name=auto-deploy-zipped,value=false) {"outcome" => "success"}
Configure the path attribute
Use thewrite-attribute
operation to modify the path attribute, substituting the examplenewpathname
value for the new path name for the deployment scanner to monitor. Note that the server will require a reload to take effect.[standalone@localhost:9999 scanner=default] :write-attribute(name=path,value=newpathname) { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } }
Configure the relative path attribute
Use thewrite-attribute
operation to modify the relative reference to the filesystem path defined in the paths section of the configuration XML file. Note that the server will require a reload to take effect.[standalone@localhost:9999 scanner=default] :write-attribute(name=relative-to,value=new.relative.dir) { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } }
Disable the deployment scanner
Use thewrite-attribute
operation to disable the deployment scanner by setting thescan-enabled
value to false.[standalone@localhost:9999 scanner=default] :write-attribute(name=scan-enabled,value=false) {"outcome" => "success"}
Change the scan interval
Use thewrite-attribute
operation to modify the scan interval time from 5000 milliseconds to 10000 milliseconds.[standalone@localhost:9999 scanner=default] :write-attribute(name=scan-interval,value=10000) {"outcome" => "success"}
Your configuration changes are saved to the deployment scanner.
9.5. Deploy with Maven
9.5.1. Manage Application Deployment with Maven
9.5.2. Deploy an Application with Maven
Prerequisites
This task shows a method for deploying applications with Maven. The example provided uses the jboss-as-helloworld.war
application found in the JBoss EAP 6 Quick Starts collection. The helloworld
project contains a POM file which initializes the jboss-as-maven-plugin
. This plugin provides simple operations to deploy and undeploy applications to and from the application server.
Procedure 9.11. Deploy an application with Maven
Run the Maven deploy command in a terminal session
Open a terminal session and navigate to the directory containing the quickstart examples.- Run the Maven deploy command to deploy the application. If the application is already running, it will be redeployed.
[localhost]$ mvn package jboss-as:deploy
Confirm the application deployment
View result in terminal window
The deployment can be confirmed by viewing the operation logs in the terminal window.Example 9.5. Maven confirmation for helloworld application
[INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESSFUL [INFO] ------------------------------------------------------------------------ [INFO] Total time: 3 seconds [INFO] Finished at: Mon Oct 10 17:22:05 EST 2011 [INFO] Final Memory: 21M/343M [INFO] ------------------------------------------------------------------------
View results in server terminal window
The deployment can also be confirmed in the status stream of the active application server instance.Example 9.6. Application server confirmation for helloworld application
17:22:04,922 INFO [org.jboss.as.server.deployment] (pool-1-thread-3) Content added at location /home/username/EAP_HOME/standalone/data/content/2c/39607b0c8dbc6a36585f72866c1bcfc951f3ff/content 17:22:04,924 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) Starting deployment of "jboss-as-helloworld.war" 17:22:04,954 INFO [org.jboss.weld] (MSC service thread 1-3) Processing CDI deployment: jboss-as-helloworld.war 17:22:04,973 INFO [org.jboss.weld] (MSC service thread 1-2) Starting Services for CDI deployment: jboss-as-helloworld.war 17:22:04,979 INFO [org.jboss.weld] (MSC service thread 1-4) Starting weld service 17:22:05,051 INFO [org.jboss.web] (MSC service thread 1-2) registering web context: /jboss-as-helloworld 17:22:05,064 INFO [org.jboss.as.server.controller] (pool-1-thread-3) Deployed "jboss-as-helloworld.war"
The application is deployed to the application server.
9.5.3. Undeploy an Application with Maven
Prerequisites
This task shows a method for undeploying applications with Maven. The example provided uses the jboss-as-helloworld.war
application found in the Enterprise Application Server Quick Starts collection. The helloworld
project contains a POM file which initializes the jboss-as-maven-plugin
. This plug-in provides simple operations to deploy and undeploy applications to and from the application server.
Procedure 9.12. Undeploy an application with Maven
Run the Maven deploy command in a terminal session
Open a terminal session and navigate to the directory containing the quickstart examples.Example 9.7. Change into the helloworld application directory
[localhost]$ cd /path/to/EAP_Quickstarts/helloworld
- Run the Maven undeploy command to undeploy the application.
[localhost]$ mvn jboss-as:undeploy
Confirm the application undeployment
View result in terminal window
The undeployment can be confirmed by viewing the operation logs in the terminal window.Example 9.8. Maven confirmation for helloworld application
[INFO] ------------------------------------------------------------------------ [INFO] Building JBoss AS Quickstarts: Helloworld [INFO] task-segment: [jboss-as:undeploy] [INFO] ------------------------------------------------------------------------ [INFO] [jboss-as:undeploy {execution: default-cli}] [INFO] Executing goal undeploy for /home/username/EAP_Quickstarts/helloworld/target/jboss-as-helloworld.war on server localhost (127.0.0.1) port 9999. Oct 10, 2011 5:33:02 PM org.jboss.remoting3.EndpointImpl <clinit> INFO: JBoss Remoting version 3.2.0.Beta2 Oct 10, 2011 5:33:02 PM org.xnio.Xnio <clinit> INFO: XNIO Version 3.0.0.Beta2 Oct 10, 2011 5:33:02 PM org.xnio.nio.NioXnio <clinit> INFO: XNIO NIO Implementation Version 3.0.0.Beta2 [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESSFUL [INFO] ------------------------------------------------------------------------ [INFO] Total time: 1 second [INFO] Finished at: Mon Oct 10 17:33:02 EST 2011 [INFO] Final Memory: 11M/212M [INFO] ------------------------------------------------------------------------
View results in server terminal window
The undeployment can also be confirmed in the status stream of the active application server instance.Example 9.9. Application server confirmation for helloworld application
17:33:02,334 INFO [org.jboss.weld] (MSC service thread 1-3) Stopping weld service 17:33:02,342 INFO [org.jboss.as.server.deployment] (MSC service thread 1-3) Stopped deployment jboss-as-helloworld.war in 15ms 17:33:02,352 INFO [org.jboss.as.server.controller] (pool-1-thread-5) Undeployed "jboss-as-helloworld.war"
The application is undeployed from the application server.
9.6. Control the order of Deployed Applications on JBoss EAP 6
Procedure 9.13. Control the order of deployment in EAP 6.0.X
- Create CLI scripts that will deploy and undeploy the applications in sequential order when the server is started/stopped.
- CLI also supports the concept of batch mode which allows you to group commands and operations and execute them together as an atomic unit. If at least one of the commands or operations fails, all the other successfully executed commands and operations in the batch are rolled back.
Procedure 9.14. Control the order of deployment in EAP 6.1.X
- Create (if it doesn't exist) a
jboss-all.xml
file in theapp.ear/META-INF
folder, whereapp.ear
is the application archive that depends on another application archive to be deployed before it is. - Make a
jboss-deployment-dependencies
entry in this file as shown below. Note that in the listing below,framework.ear
is the dependency application archive that should be deployed beforeapp.ear
application archive is.<jboss umlns="urn:jboss:1.0"> <jboss-deployment-dependencies xmlns="urn:jboss:deployment-dependencies:1.0"> <dependency name="framework.ear" /> </jboss-deployment-dependencies> </jboss>
Chapter 10. Securing JBoss EAP 6
10.1. About the Security Subsystem
If deep copy subject mode is disabled (the default), copying a security data structure makes a reference to the original, rather than copying the entire data structure. This behavior is more efficient, but is prone to data corruption if multiple threads with the same identity clear the subject by means of a flush or logout operation.
You can set system-wide security properties, which are applied to java.security.Security class
.
A security domain is a set of Java Authentication and Authorization Service (JAAS) declarative security configurations which one or more applications use to control authentication, authorization, auditing, and mapping. Three security domains are included by default: jboss-ejb-policy
, jboss-web-policy
, and other
. You can create as many security domains as you need to accommodate the needs of your applications.
10.2. About the Structure of the Security Subsystem
Example 10.1. Example Security Subsystem Configuration
<subsystem xmlns="urn:jboss:domain:security:1.2"> <security-management> ... </security-management> <security-domains> <security-domain name="other" cache-type="default"> <authentication> <login-module code="Remoting" flag="optional"> <module-option name="password-stacking" value="useFirstPass"/> </login-module> <login-module code="RealmUsersRoles" flag="required"> <module-option name="usersProperties" value="${jboss.domain.config.dir}/application-users.properties"/> <module-option name="rolesProperties" value="${jboss.domain.config.dir}/application-roles.properties"/> <module-option name="realm" value="ApplicationRealm"/> <module-option name="password-stacking" value="useFirstPass"/> </login-module> </authentication> </security-domain> <security-domain name="jboss-web-policy" cache-type="default"> <authorization> <policy-module code="Delegating" flag="required"/> </authorization> </security-domain> <security-domain name="jboss-ejb-policy" cache-type="default"> <authorization> <policy-module code="Delegating" flag="required"/> </authorization> </security-domain> </security-domains> <vault> ... </vault> </subsystem>
<security-management>
, <subject-factory>
and <security-properties>
elements are not present in the default configuration. The <subject-factory>
and <security-properties>
elements have been deprecated in JBoss EAP 6.1 onwards.
10.3. Configure the Security Subsystem
- <security-management>
- This section overrides high-level behaviors of the security subsystem. Each setting is optional. It is unusual to change any of these settings except for deep copy subject mode.
Option Description deep-copy-subject-mode Specifies whether to copy or link to security tokens, for additional thread safety.authentication-manager-class-name Specifies an alternate AuthenticationManager implementation class name to use.authorization-manager-class-name Specifies an alternate AuthorizationManager implementation class name to use.audit-manager-class-name Specifies an alternate AuditManager implementation class name to use.identity-trust-manager-class-name Specifies an alternate IdentityTrustManager implementation class name to use.mapping-manager-class-name Specifies the MappingManager implementation class name to use. - <subject-factory>
- The subject factory controls creation of subject instances. It may use the authentication manager to verify the caller. The main use of the subject factory is for JCA components to establish a subject.It is unusual to need to modify the subject factory.
- <security-domains>
- A container element which holds multiple security domains. A security domain may contain information about authentication, authorization, mapping, and auditing modules, as well as JASPI authentication and JSSE configuration. Your application would specify a security domain to manage its security information.
- <security-properties>
- Contains names and values of properties which are set on the java.security.Security class.
10.4. About Deep Copy Subject Mode
10.5. Enable Deep Copy Subject Mode
Procedure 10.1. Enable Deep Copy Security Mode from the Management Console
Log into the Management Console.
The management console is usually available at a URL such as http://127.0.0.1:9990/. Adjust this value to suit your needs.Managed Domain: Select the appropriate profile.
In a managed domain, the security subsystem is configured per profile, and you can enable or disable the deep copy security mode in each, independently.To select a profile, click the Profiles label at the top right of the console display, and then select the profile you wish to change from the Profile selection box at the top left.Open the Security Subsystem configuration menu.
Expand the Security menu item at the right of the management console, then click the Security Subsystem link.Modify the deep-copy-subject-mode value.
Click the Edit button. Check the box beside Deep Copy Subjects: to enable deep copy subject mode.
If you prefer to use the management CLI to enable this option, use one of the following commands.
Example 10.2. Managed Domain
/profile=full/subsystem=security:write-attribute(name=deep-copy-subject-mode,value=TRUE)
Example 10.3. Standalone Server
/subsystem=security:write-attribute(name=deep-copy-subject-mode,value=TRUE)
10.6. Security Domains
10.6.1. About Security Domains
10.6.2. About Picketbox
- Section 10.6.5, “About Authorization” and access control
- Section 10.6.9, “About Security Mapping” of principals, roles, and attributes
10.6.3. About Authentication
10.6.4. Configure Authentication in a Security Domain
Procedure 10.2. Setup Authentication Settings for a Security Domain
Open the security domain's detailed view.
Click the Profiles label at the top right of the management console. In a managed domain, select the profile to modify from the Profile selection box at the top left of the Profile view. Click the Security menu item at the left, and click Security Domains from the expanded menu. Click the View link for the security domain you want to edit.Navigate to the Authentication subsystem configuration.
Click the Authentication label at the top of the view if it is not already selected.The configuration area is divided into two areas: Login Modules and Details. The login module is the basic unit of configuration. A security domain can include several login modules, each of which can include several attributes and options.Add an authentication module.
Click the Add button to add a JAAS authentication module. Fill in the details for your module. The Code is the class name of the module. The Flags controls how the module relates to other authentication modules within the same security domain.Explanation of the FlagsThe Java Enterprise Edition 6 specification provides the following explanation of the flags for security modules. The following list is taken from http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/JAASRefGuide.html#AppendixA. Refer to that document for more detailed information.
Flag Details required The LoginModule is required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list.requisite LoginModule is required to succeed. If it succeeds, authentication continues down the LoginModule list. If it fails, control immediately returns to the application (authentication does not proceed down the LoginModule list).sufficient The LoginModule is not required to succeed. If it does succeed, control immediately returns to the application (authentication does not proceed down the LoginModule list). If it fails, authentication continues down the LoginModule list.optional The LoginModule is not required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list.After you have added your module, you can modify its Code or Flags by clicking the Edit button in the Details section of the screen. Be sure the Attributes tab is selected.Optional: Add or remove module options.
If you need to add options to your module, click its entry in the Login Modules list, and select the Module Options tab in the Details section of the page. Click the Add button, and provide the key and value for the option. Use the Remove button to remove an option.
Your authentication module is added to the security domain, and is immediately available to applications which use the security domain.
jboss.security.security_domain
Module Option
By default, each login module defined in a security domain has the jboss.security.security_domain
module option added to it automatically. This option causes problems with login modules which check to make sure that only known options are defined. The IBM Kerberos login module, com.ibm.security.auth.module.Krb5LoginModule
is one of these.
true
when starting JBoss EAP 6. Add the following to your start-up parameters.
-Djboss.security.disable.secdomain.option=true
10.6.5. About Authorization
10.6.6. Configure Authorization in a Security Domain
Procedure 10.3. Setup Authorization in a Security Domain
Open the security domain's detailed view.
Click the Profiles label at the top right of the management console. In a managed domain, select the profile to modify from the Profile selection box at the top left of the Profile view. Click the Security menu item at the left, and click Security Domains from the expanded menu. Click the View link for the security domain you want to edit.Navigate to the Authorization subsystem configuration.
Click the Authorization label at the top of the view if it is not already selected.The configuration area is divided into two areas: Policies and Details. The login module is the basic unit of configuration. A security domain can include several authorization policies, each of which can include several attributes and options.Add a policy.
Click the Add button to add a JAAS authorization policy module. Fill in the details for your module. The Code is the class name of the module. The Flags controls how the module relates to other authorization policy modules within the same security domain.Explanation of the FlagsThe Java Enterprise Edition 6 specification provides the following explanation of the flags for security modules. The following list is taken from http://docs.oracle.com/javase/6/docs/technotes/guides/security/jaas/JAASRefGuide.html#AppendixA. Refer to that document for more detailed information.
Flag Details Required The LoginModule is required to succeed. If it succeeds or fails, authorization still continues to proceed down the LoginModule list.Requisite LoginModule is required to succeed. If it succeeds, authorization continues down the LoginModule list. If it fails, control immediately returns to the application (authorization does not proceed down the LoginModule list).Sufficient The LoginModule is not required to succeed. If it does succeed, control immediately returns to the application (authorization does not proceed down the LoginModule list). If it fails, authorization continues down the LoginModule list.Optional The LoginModule is not required to succeed. If it succeeds or fails, authorization still continues to proceed down the LoginModule list.After you have added your module, you can modify its Code or Flags by clicking the Edit button in the Details section of the screen. Be sure the Attributes tab is selected.Optional: Add, edit, or remove module options.
If you need to add options to your module, click its entry in the Login Modules list, and select the Module Options tab in the Details section of the page. Click the Add button, and provide the key and value for the option. To edit an option that already exists, click the key or to change it. Use the Remove button to remove an option.
Your authorization policy module is added to the security domain, and is immediately available to applications which use the security domain.
10.6.7. About Security Auditing
10.6.8. Configure Security Auditing
Procedure 10.4. Setup Security Auditing for a Security Domain
Open the security domain's detailed view.
Click the Profiles label at the top right of the management console. In a standalone server, the tab is labeled Profile. In a managed domain, select the profile to modify from the Profile selection box at the top left of the Profile view. Click the Security menu item at the left, and click Security Domains from the expanded menu. Click the View link for the security domain you want to edit.Navigate to the Auditing subsystem configuration.
Click the Audit label at the top of the view if it is not already selected.The configuration area is divided into two areas: Provider Modules and Details. The provider module is the basic unit of configuration. A security domain can include several provider modules each of which can include attributes and options.Add a provider module.
Click the Add button to add a provider module. Fill in the Code section with the classname of the provider module.After you have added your module, you can modify its Code by clicking the Edit button in the Details section of the screen. Be sure the Attributes tab is selected.Verify if your module is working
The goal of an audit module is to provide a way to monitor the events in the security subsystem. This monitoring can be done by means of writing to a log file, email notifications or any other measurable auditing mechanism.For example, JBoss EAP 6 includes theLogAuditProvider
module by default. If enabled following the steps above, this audit module writes security notifications to aaudit.log
file in thelog
subfolder within theEAP_HOME
directory.To verify if the steps above have worked in the context of theLogAuditProvider
, perform an action that is likely to trigger a notification and then check the audit log file.For a full list of included security auditing provider modules, see here: Section 11.4, “Included Security Auditing Provider Modules”Optional: Add, edit, or remove module options.
If you need to add options to your module, click its entry in the Modules list, and select the Module Options tab in the Details section of the page. Click the Add button, and provide the key and value for the option. To edit an option that already exists, remove it by clicking the Remove label, and add it again with the correct options by clicking the Add button.
Your security auditing module is added to the security domain, and is immediately available to applications which use the security domain.
10.6.9. About Security Mapping
10.6.10. Configure Security Mapping in a Security Domain
Procedure 10.5. Setup Security Mapping Settings in a Security Domain
Open the security domain's detailed view.
Click the Profiles label at the top right of the management console. This tab is labeled Profile in a standalone server. In a managed domain, select the profile to modify from the Profile selection box at the top left of the Profile view. Click the Security menu item at the left, and click Security Domains from the expanded menu. Click the View link for the security domain you want to edit.Navigate to the Mapping subsystem configuration.
Click the Mapping label at the top of the view if it is not already selected.The configuration area is divided into two areas: Modules and Details. The mapping module is the basic unit of configuration. A security domain can include several mapping modules, each of which can include several attributes and options.Add a module.
Click the Add button to add a security mapping module. Fill in the details for your module. The Code is the class name of the module. The Type field refers to the type of mapping this module performs. Allowed values are principal, role, attribute or credential.After you have added your module, you can modify its Code or Type by clicking the Edit button in the Details section of the screen. Be sure the Attributes tab is selected.Optional: Add, edit, or remove module options.
If you need to add options to your module, click its entry in the Modules list, and select the Module Options tab in the Details section of the page. Click the Add button, and provide the key and value for the option. To edit an option that already exists, click the Remove label key to remove it, and add it again with the new value. Use the Remove button to remove an option.
Your security mapping module is added to the security domain, and is immediately available to applications which use the security domain.
10.6.11. Use a Security Domain in Your Application
To use a security domain in your application, first you must configure the domain in either the server's configuration file or the application's descriptor file. Then you must add the required annotations to the EJB that uses it. This topic covers the steps required to use a security domain in your application.
Warning
Procedure 10.6. Configure Your Application to Use a Security Domain
Define the Security Domain
You can define the security domain either in the server's configuration file or the application's descriptor file.Configure the security domain in the server's configuration file
The security domain is configured in thesecurity
subsystem of the server's configuration file. If the JBoss EAP 6 instance is running in a managed domain, this is thedomain/configuration/domain.xml
file. If the JBoss EAP 6 instance is running as a standalone server, this is thestandalone/configuration/standalone.xml
file.Theother
,jboss-web-policy
, andjboss-ejb-policy
security domains are provided by default in JBoss EAP 6. The following XML example was copied from thesecurity
subsystem in the server's configuration file.<subsystem xmlns="urn:jboss:domain:security:1.2"> <security-domains> <security-domain name="other" cache-type="default"> <authentication> <login-module code="Remoting" flag="optional"> <module-option name="password-stacking" value="useFirstPass"/> </login-module> <login-module code="RealmDirect" flag="required"> <module-option name="password-stacking" value="useFirstPass"/> </login-module> </authentication> </security-domain> <security-domain name="jboss-web-policy" cache-type="default"> <authorization> <policy-module code="Delegating" flag="required"/> </authorization> </security-domain> <security-domain name="jboss-ejb-policy" cache-type="default"> <authorization> <policy-module code="Delegating" flag="required"/> </authorization> </security-domain> </security-domains> </subsystem>
You can configure additional security domains as needed using the Management Console or CLI.Configure the security domain in the application's descriptor file
The security domain is specified in the<security-domain>
child element of the<jboss-web>
element in the application'sWEB-INF/jboss-web.xml
file. The following example configures a security domain namedmy-domain
.<jboss-web> <security-domain>my-domain</security-domain> </jboss-web>
This is only one of many settings which you can specify in theWEB-INF/jboss-web.xml
descriptor.
Add the Required Annotation to the EJB
You configure security in the EJB using the@SecurityDomain
and@RolesAllowed
annotations. The following EJB code example limits access to theother
security domain by users in theguest
role.package example.ejb3; import java.security.Principal; import javax.annotation.Resource; import javax.annotation.security.RolesAllowed; import javax.ejb.SessionContext; import javax.ejb.Stateless; import org.jboss.ejb3.annotation.SecurityDomain; /** * Simple secured EJB using EJB security annotations * Allow access to "other" security domain by users in a "guest" role. */ @Stateless @RolesAllowed({ "guest" }) @SecurityDomain("other") public class SecuredEJB { // Inject the Session Context @Resource private SessionContext ctx; /** * Secured EJB method using security annotations */ public String getSecurityInfo() { // Session context injected using the resource annotation Principal principal = ctx.getCallerPrincipal(); return principal.toString(); } }
For more code examples, see theejb-security
quickstart in the JBoss EAP 6 Quickstarts bundle, which is available from the Red Hat Customer Portal.
10.6.12. Java Authorization Contract for Containers (JACC)
10.6.12.1. About Java Authorization Contract for Containers (JACC)
10.6.12.2. Configure Java Authorization Contract for Containers (JACC) Security
jboss-web.xml
to include the correct parameters.
To add JACC support to the security domain, add the JACC
authorization policy to the authorization stack of the security domain, with the required
flag set. The following is an example of a security domain with JACC support. However, the security domain is configured in the Management Console or Management CLI, rather than directly in the XML.
<security-domain name="jacc" cache-type="default"> <authentication> <login-module code="UsersRoles" flag="required"> </login-module> </authentication> <authorization> <policy-module code="JACC" flag="required"/> </authorization> </security-domain>
The jboss-web.xml
is located in the META-INF/
or WEB-INF/
directory of your deployment, and contains overrides and additional JBoss-specific configuration for the web container. To use your JACC-enabled security domain, you need to include the <security-domain>
element, and also set the <use-jboss-authorization>
element to true
. The following application is properly configured to use the JACC security domain above.
<jboss-web> <security-domain>jacc</security-domain> <use-jboss-authorization>true</use-jboss-authorization> </jboss-web>
Configuring EJBs to use a security domain and to use JACC differs from Web Applications. For an EJB, you can declare method permissions on a method or group of methods, in the ejb-jar.xml
descriptor. Within the <ejb-jar>
element, any child <method-permission>
elements contain information about JACC roles. Refer to the example configuration for more details. The EJBMethodPermission
class is part of the Java Enterprise Edition 6 API, and is documented at http://docs.oracle.com/javaee/6/api/javax/security/jacc/EJBMethodPermission.html.
Example 10.4. Example JACC Method Permissions in an EJB
<ejb-jar> <method-permission> <description>The employee and temp-employee roles may access any method of the EmployeeService bean </description> <role-name>employee</role-name> <role-name>temp-employee</role-name> <method> <ejb-name>EmployeeService</ejb-name> <method-name>*</method-name> </method> </method-permission> </ejb-jar>
jboss-ejb3.xml
descriptor, in the <security>
child element. In addition to the security domain, you can also specify the run-as principal, which changes the principal the EJB runs as.
Example 10.5. Example Security Domain Declaration in an EJB
<security> <ejb-name>*</ejb-name> <security-domain>myDomain</security-domain> <run-as-principal>myPrincipal</run-as-principal> </security>
10.6.13. Java Authentication SPI for Containers (JASPI)
10.6.13.1. About Java Authentication SPI for Containers (JASPI) Security
10.6.13.2. Configure Java Authentication SPI for Containers (JASPI) Security
<authentication-jaspi>
element to your security domain. The configuration is similar to a standard authentication module, but login module elements are enclosed in a <login-module-stack>
element. The structure of the configuration is:
Example 10.6. Structure of the authentication-jaspi
element
<authentication-jaspi> <login-module-stack name="..."> <login-module code="..." flag="..."> <module-option name="..." value="..."/> </login-module> </login-module-stack> <auth-module code="..." login-module-stack-ref="..."> <module-option name="..." value="..."/> </auth-module> </authentication-jaspi>
EAP_HOME/domain/configuration/domain.xml
or EAP_HOME/standalone/configuration/standalone.xml
.
10.7. Management Interface Security
10.7.1. Default User Security Configuration
All management interfaces in JBoss EAP 6 are secured by default. This security takes two different forms:
- Local interfaces are secured by a SASL contract between local clients and the server they connect to. This security mechanism is based on the client's ability to access the local filesystem. This is because access to the local filesystem would allow the client to add a user or otherwise change the configuration to thwart other security mechanisms. This adheres to the principle that if physical access to the filesystem is achieved, other security mechanisms are superfluous. The mechanism happens in four steps:
Note
HTTP access is considered to be remote, even if you connect to the localhost using HTTP.- The client sends a message to the server which includes a request to authenticate with the local SASL mechanism.
- The server generates a one-time token, writes it to a unique file, and sends a message to the client with the full path of the file.
- The client reads the token from the file and sends it to the server, verifying that it has local access to the filesystem.
- The server verifies the token and then deletes the file.
- Remote clients, including local HTTP clients, use realm-based security. The default realm with the permissions to configure the JBoss EAP 6 remotely using the management interfaces is
ManagementRealm
. A script is provided which allows you to add users to this realm (or realms you create). For more information on adding users, refer to the Getting Started chapter of the Installation guide for JBoss EAP 6. For each user, the username, a hashed password, and the realm are stored in a file.- Standalone server
JPP_HOME/standalone/configuration/mgmt-users.properties
Even though the contents of themgmt-users.properties
are masked, the file should still be treated as a sensitive file. It is recommended that it be set to the file mode of600
, which gives no access other than read and write access by the file owner.
10.7.2. Overview of Advanced Management Interface Configuration
EAP_HOME/domain/configuration/host.xml
or EAP_HOME/standalone/configuration/standalone.xml
controls which network interfaces the host controller process binds to, which types of management interfaces are available at all, and which type of authentication system is used to authenticate users on each interface. This topic discusses how to configure the Management Interfaces to suit your environment.
<management>
element that includes several configurable attributes, and the following three configurable child elements. The security realms and outbound connections are each first defined, and then applied to the management interfaces as attributes.
<security-realms>
<outbound-connections>
<management-interfaces>
The security realm is responsible for the authentication and authorization of users allowed to administer JBoss EAP 6 via the Management API, Management CLI, or web-based Management Console.
ManagementRealm
and ApplicationRealm
. Each of these security realms uses a -users.properties
file to store users and hashed passwords, and a -roles.properties
to store mappings between users and roles. Support is also included for an LDAP-enabled security realm.
Note
Some security realms connect to external interfaces, such as an LDAP server. An outbound connection defines how to make this connection. A pre-defined connection type, ldap-connection
, sets all of the required and optional attributes to connect to the LDAP server and verify the credential.
A management interface includes properties about how connect to and configure JBoss EAP. Such information includes the named network interface, port, security realm, and other configurable information about the interface. Two interfaces are included in a default installation:
http-interface
is the configuration for the web-based Management Console.native-interface
is the configuration for the command-line Management CLI and the REST-like Management API.
10.7.3. About LDAP
10.7.4. Use LDAP to Authenticate to the Management Interfaces
- Create an outbound connection to the LDAP server.
- Create an LDAP-enabled security realm.
- Reference the new security domain in the Management Interface.
The LDAP outbound connection allows the following attributes:
Table 10.1. Attributes of an LDAP Outbound Connection
Attribute | Required | Description |
---|---|---|
name | yes |
The name to identify this connection. This name is used in the security realm definition.
|
url | yes |
The URL address of the directory server.
|
search-dn | yes |
The fully distinguished name (DN) of the user authorized to perform searches.
|
search-credentials | yes |
The password of the user authorized to perform searches.
|
initial-context-factory | no |
The initial context factory to use when establishing the connection. Defaults to
com.sun.jndi.ldap.LdapCtxFactory .
|
Example 10.7. Add an LDAP Outbound Connection
- Search DN:
cn=search,dc=acme,dc=com
- Search Credential:
myPass
- URL:
ldap://127.0.0.1:389
/host=master/core-service=management/ldap-connection=ldap_connection/:add(search-credential=myPass,url=ldap://127.0.0.1:389,search-dn="cn=search,dc=acme,dc=com")
Example 10.8. XML Representing an LDAP Outbound Connection
<outbound-connections> <ldap name="ldap_connection" url="ldap://127.0.0.1:389" search-dn="cn=search,dc=acme,dc=com" search-credential="myPass" /> </outboundconnections>
The Management Interfaces can authenticate against LDAP server instead of the property-file based security realms configured by default. The LDAP authenticator operates by first establishing a connection to the remote directory server. It then performs a search using the username which the user passed to the authentication system, to find the fully-qualified distinguished name (DN) of the LDAP record. A new connection is established, using the DN of the user as the credential, and password supplied by the user. If this authentication to the LDAP server is successful, the DN is verified to be valid.
- connection
- The name of the connection defined in
<outbound-connections>
to use to connect to the LDAP directory. - base-dn
- The distinguished name of the context to begin searching for the user.
- recursive
- Whether the search should be recursive throughout the LDAP directory tree, or only search the specified context. Defaults to
false
. - user-dn
- The attribute of the user that holds the distinguished name. This is subsequently used to test authentication as the user can complete. Defaults to
dn
. - One of
username-filter
oradvanced-filter
, as a child element - The
username-filter
takes a single attribute calledattribute
, whose value is the name of the LDAP attribute which holds the username, such asuserName
orsambaAccountName
.Theadvanced-filter
takes a single attribute calledfilter
. This attribute contains a filter query in standard LDAP syntax. Be cautious to escape any&
characters by changing them to&
. An example of a filter is:(&(sAMAccountName={0})(memberOf=cn=admin,cn=users,dc=acme,dc=com))
After escaping the ampersand character, the filter appears as:(&(sAMAccountName={0})(memberOf=cn=admin,cn=users,dc=acme,dc=com))
Example 10.9. XML Representing an LDAP-enabled Security Realm
- connection -
ldap_connection
- base-dn -
cn=users,dc=acme,dc=com
. - username-filter -
attribute="sambaAccountName"
<security-realm name="TestRealm"> <authentication> <ldap connection="ldap_connection" base-dn="cn=users,dc=acme,dc=com"> <username-filter attribute="sambaAccountName" /> </ldap> </authentication> </security-realm>
Warning
Example 10.10. Add an LDAP Security Realm
/host=master/core-service=management/security-realm=ldap_security_realm/authentication=ldap:add(base-dn="DC=mycompany,DC=org", recursive=true, username-attribute="MyAccountName", connection="ldap_connection")
After you create a security realm, you need to reference it in the configuration of your management interface. The management interface will use the security realm for HTTP digest authentication.
Example 10.11. Apply the Security Realm to the HTTP Interface
/host=master/core-service=management/management-interface=http-interface/:write-attribute(name=security-realm,value=TestRealm)
10.7.5. Disable the HTTP Management Interface
Note
console-enabled
attribute of the HTTP interface to false
, instead of disabling the interface completely.
/host=master/core-service=management/management-interface=http-interface/:write-attribute(name=console-enabled,value=false)
Example 10.12. Read the Configuration of the HTTP Interface
/host=master/core-service=management/management-interface=http-interface/:read-resource(recursive=true,proxies=false,include-runtime=false,include-defaults=true)
{
"outcome" => "success",
"result" => {
"console-enabled" => true,
"interface" => "management",
"port" => expression "${jboss.management.http.port:9990}",
"secure-port" => undefined,
"security-realm" => "ManagementRealm"
}
}
Example 10.13. Remove the HTTP Interface
/host=master/core-service=management/management-interface=http-interface/:remove
Example 10.14. Re-Create the HTTP Interface
/host=master/core-service=management/management-interface=http-interface:add(console-enabled=true,interface=management,port="${jboss.management.http.port:9990}",security-realm=ManagementRealm)
10.7.6. Remove Silent Authentication from the Default Security Realm
The default installation of JBoss EAP 6 contains a method of silent authentication for a local Management CLI user. This allows the local user the ability to access the Management CLI without username or password authentication. This functionality is enabled as a convenience, and to assist local users running Management CLI scripts without requiring authentication. It is considered a useful feature given that access to the local configuration typically also gives the user the ability to add their own user details or otherwise disable security checks.
local
element within the security-realm
section of the configuration file. This applies to both the standalone.xml
for a Standalone Server instance, or host.xml
for a Managed Domain. You should only consider the removal of the local
element if you understand the impact that it might have on your particular server configuration.
local
element visible in the following example.
Example 10.15. Example of the local
element in the security-realm
<security-realms> <security-realm name="ManagementRealm"> <authentication> <local default-user="$local"/> <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/> </authentication> </security-realm> <security-realm name="ApplicationRealm"> <authentication> <local default-user="$local" allowed-users="*"/> <properties path="application-users.properties" relative-to="jboss.server.config.dir"/> </authentication> <authorization> <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/> </authorization> </security-realm> </security-realms>
Procedure 10.7. Remove Silent Authentication from the Default Security Realm
Remove silent authentication with the Management CLI
Remove thelocal
element from the Management Realm and Application Realm as required.- Remove the
local
element from the Management Realm.For Standalone Servers
/core-service=management/security-realm=ManagementRealm/authentication=local:remove
For Managed Domains
/host=HOST_NAME/core-service=management/security-realm=ManagementRealm/authentication=local:remove
- Remove the
local
element from the Application Realm.For Standalone Servers
/core-service=management/security-realm=ApplicationRealm/authentication=local:remove
For Managed Domains
/host=HOST_NAME/core-service=management/security-realm=ApplicationRealm/authentication=local:remove
The silent authentication mode is removed from the ManagementRealm
and the ApplicationRealm
.
10.7.7. Disable Remote Access to the JMX Subsystem
/profile=default
part of the command. For a standalone server, remove that portion of the command completely.
Note
Example 10.16. Remove the Remote Connector from the JMX Subsystem
/profile=default/subsystem=jmx/remoting-connector=jmx/:remove
Example 10.17. Remove the JMX Subsystem
/profile=default/subsystem=jmx/:remove
10.7.8. Configure Security Realms for the Management Interfaces
This example shows the default configuration for the ManagementRealm
security realm. It uses a file called mgmt-users.properties
to store its configuration information.
Example 10.18. Default ManagementRealm
/host=master/core-service=management/security-realm=ManagementRealm/:read-resource(recursive=true,proxies=false,include-runtime=false,include-defaults=true)
{
"outcome" => "success",
"result" => {
"authorization" => undefined,
"server-identity" => undefined,
"authentication" => {"properties" => {
"path" => "mgmt-users.properties",
"plain-text" => false,
"relative-to" => "jboss.domain.config.dir"
}}
}
}
The following commands create a new security realm called TestRealm
and set the directory for the relevant properties file.
Example 10.19. Writing a Security Realm
/host=master/core-service=management/security-realm=TestRealm/:add
/host=master/core-service=management/security-realm=TestRealm/authentication=properties/:add(path=TestUsers.properties, relative-to=jboss.domain.config.dir)
After adding a security realm, supply it as a reference to the Management Interface.
Example 10.20. Add a Security Realm to a Management Interface
/host=master/core-service=management/management-interface=http-interface/:write-attribute(security-realm=TestRealm)
10.8. Network Security
10.8.1. Secure the Management Interfaces
In a test environment, it is typical to run JBoss EAP 6 with no security layer on the management interfaces, comprised of the Management Console, Management CLI, and any other API implementation. This allows for rapid development and configuration changes.
10.8.2. Specify Which Network Interface JBoss EAP 6 Uses
Isolating services so that they are accessible only to the clients who need them increases the security of your network. JBoss EAP 6 includes two interfaces in its default configuration, both of which bind to the IP address 127.0.0.1
, or localhost
, by default. One of the interfaces is called management
, and is used by the Management Console, CLI, and API. The other is called public
, and is used to deploy applications. These interfaces are not special or significant, but are provided as a starting point.
management
interface uses ports 9990 and 9999 by default, and the public
interface uses port 8080, or port 8443 if you use HTTPS.
Warning
Stop JBoss EAP 6.
Stop JBoss EAP 6 by sending an interrupt in the appropriate way for your operating system. If you are running JBoss EAP 6 as a foreground application, the typical way to do this is to press Ctrl+C.Restart JBoss EAP 6, specifying the bind address.
Use the-b
command-line switch to start JBoss EAP 6 on a specific interface.Example 10.21. Specify the public interface.
EAP_HOME/bin/domain.sh -b 10.1.1.1
Example 10.22. Specify the management interface.
EAP_HOME/bin/domain.sh -bmanagement=10.1.1.1
Example 10.23. Specify different addresses for each interface.
EAP_HOME/bin/domain.sh -bmanagement=127.0.0.1 -b 10.1.1.1
Example 10.24. Bind the public interface to all network interfaces.
EAP_HOME/bin/domain.sh -b 0.0.0.0
-b
command-line switch to specify an IP address at run-time, so this is not recommended. If you do decide to do this, be sure to stop JBoss EAP 6 completely before editing the XML file.
10.8.3. Configure Network Firewalls to Work with JBoss EAP 6
Most production environments use firewalls as part of an overall network security strategy. If you need multiple server instances to communicate with each other or with external services such as web servers or databases, your firewall needs to take this into account. A well-managed firewall only opens the ports which are necessary for operation, and limits access to the ports to specific IP addresses, subnets, and network protocols.
Prerequisites
- Determine the ports you need to open. Refer to Section 10.8.4, “Network Ports Used By JBoss EAP 6” to determine the list of ports for your situation.
- An understanding of your firewall software is required. This procedure uses the
system-config-firewall
command in Red Hat Enterprise Linux 6. Microsoft Windows Server includes a built-in firewall, and several third-party firewall solutions are available for each platform.
This procedure configures a firewall in an environment with the following assumptions:
- The operating system is Red Hat Enterprise Linux 6.
- JBoss EAP 6 runs on host
10.1.1.2
. Optionally, the server has its own firewall. - The network firewall server runs on host
10.1.1.1
on interfaceeth0
, and has an external interfaceeth1
. - You want traffic on port 5445 (a port used by JMS) forwarded to JBoss EAP 6. No other traffic should be allowed through the network firewall.
Procedure 10.8. Manage Network Firewalls and JBoss EAP 6 to work together
Log into the Management Console.
Log into the Management Console. By default, it runs on http://localhost:9990/console/.Determine the socket bindings used by the socket binding group.
Click the Profiles label at the top right of the Management Console. At the left-hand side of the screen, a series of menus is shown. The bottom menu heading is General Configuration. Click the Socket Binding item below this heading. The Socket Binding Declarations screen appears. Initially, thestandard-sockets
group is shown. You can choose a different group by selecting it from the combo box on the right-hand side.Note
If you use a standalone server, it has only one socket binding group.The list of socket names and ports is shown, eight values per page. You can go through the pages by using the arrow navigation below the table.Determine the ports you need to open.
Depending on the function of the particular port and the needs of your environment, some of the ports may need to be accessible across your firewall. If you are unsure of the purpose of a socket binding, refer to Section 10.8.4, “Network Ports Used By JBoss EAP 6” for a list of the default socket bindings and their purposes.Configure your firewall to forward traffic to JBoss EAP 6.
Perform these steps to configure your network firewall to allow traffic on the desired port.- Log into your firewall machine and access a command prompt, as the root user.
- Issue the command
system-config-firewall
to launch the firewall configuration utility. A GUI or command-line utility launches, depending on the way you are logged into the firewall system. This task makes the assumption that you are logged in via SSH and using the command-line interface. - Use the TAB key on your keyboard to navigate to the Customize button, and press the ENTER key. The Trusted Services screen appears.
- Do not change any values, but use the TAB key to navigate to the Forward button, and press ENTER to advanced to the next screen. The Other Ports screen appears.
- Use the TAB key to navigate to the <Add> button, and press ENTER. The Port and Protocol screen appears.
- Enter
5445
in the Port / Port Range field, then use the TAB key to move to the Protocol field, and entertcp
. Use the TAB key to navigate to the OK button, and press ENTER. - Use the TAB key to navigate to the Forward button until you reach the Port Forwarding screen.
- Use the TAB key to navigate to the <Add> button, and press the ENTER key.
- Fill in the following values to set up port forwarding for port 5445.
- Source interface: eth1
- Protocol: tcp
- Port / Port Range: 5445
- Destination IP address: 10.1.1.2
- Port / Port Range: 5445
Use the TAB key to navigate to the OK button, and press ENTER. - Use the TAB key to navigate to the Close button, and press ENTER.
- Use the TAB key to navigate to the OK button, and press ENTER. To apply the changes, read the warning and click Yes.
Configure a firewall on your JBoss EAP 6 host.
Some organizations choose to configure a firewall on the JBoss EAP 6 server itself, and close all ports that are not necessary for its operation. Consult Section 10.8.4, “Network Ports Used By JBoss EAP 6” and determine which ports to open, then close the rest. The default configuration of Red Hat Enterprise Linux 6 closes all ports except 22 (used for Secure Shell (SSH) and 5353 (used for multicast DNS). While you are configuring ports, make sure you have physical access to your server so that you do not inadvertently lock yourself out.
Your firewall is configured to forward traffic to your internal JBoss EAP 6 server in the way you specified in your firewall configuration. If you chose to enable a firewall on your server, all ports are closed except the ones needed to run your applications.
10.8.4. Network Ports Used By JBoss EAP 6
- Whether your server groups use one of the default socket binding groups, or a custom group.
- The requirements of your individual deployments.
Note
The default socket binding groups
full-ha-sockets
full-sockets
ha-sockets
standard-sockets
Table 10.2. Reference of the default socket bindings
Name | Port | Mulicast Port | Description | full-ha-sockets | full-sockets | ha-socket | standard-socket |
---|---|---|---|---|---|---|---|
ajp | 8009 | Apache JServ Protocol. Used for HTTP clustering and load balancing. | Yes | Yes | Yes | Yes | |
http | 8080 | The default port for deployed web applications. | Yes | Yes | Yes | Yes | |
https | 8443 | SSL-encrypted connection between deployed web applications and clients. | Yes | Yes | Yes | Yes | |
jacorb | 3528 | CORBA services for JTS transactions and other ORB-dependent services. | Yes | Yes | No | No | |
jacorb-ssl | 3529 | SSL-encrypted CORBA services. | Yes | Yes | No | No | |
jgroups-diagnostics | 7500 | Multicast. Used for peer discovery in HA clusters. Not configurable using the Management Interfaces. | Yes | No | Yes | No | |
jgroups-mping | 45700 | Multicast. Used to discover initial membership in a HA cluster. | Yes | No | Yes | No | |
jgroups-tcp | 7600 | Unicast peer discovery in HA clusters using TCP. | Yes | No | Yes | No | |
jgroups-tcp-fd | 57600 | Used for HA failure detection over TCP. | Yes | No | Yes | No | |
jgroups-udp | 55200 | 45688 | Unicast peer discovery in HA clusters using UDP. | Yes | No | Yes | No |
jgroups-udp-fd | 54200 | Used for HA failure detection over UDP. | Yes | No | Yes | No | |
messaging | 5445 | JMS service. | Yes | Yes | No | No | |
messaging-group | Referenced by HornetQ JMS broadcast and discovery groups. | Yes | Yes | No | No | ||
messaging-throughput | 5455 | Used by JMS Remoting. | Yes | Yes | No | No | |
mod_cluster | 23364 | Multicast port for communication between JBoss EAP 6 and the HTTP load balancer. | Yes | No | Yes | No | |
osgi-http | 8090 | Used by internal components which use the OSGi subsystem. Not configurable using the Management Interfaces. | Yes | Yes | Yes | Yes | |
remoting | 4447 | Used for remote EJB invocation. | Yes | Yes | Yes | Yes | |
txn-recovery-environment | 4712 | The JTA transaction recovery manager. | Yes | Yes | Yes | Yes | |
txn-status-manager | 4713 | The JTA / JTS transation manager. | Yes | Yes | Yes | Yes |
In addition to the socket binding groups, each host controller opens two more ports for management purposes:
- 9990 - The Web Management Console port
- 9999 - The port used by the Management Console and Management API
10.9. Java Security Manager
10.9.1. About the Java Security Manager
The Java Security Manager is a class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM. When the Java Security Manager is activated, the Java API checks with the security manager for approval before executing a wide range of potentially unsafe operations.
10.9.2. Run JBoss EAP 6 Within the Java Security Manager
domain.sh
or standalone.sh
scripts. The following procedure guides you through the steps of configuring your instance to run within a Java Security Manager policy.
Prerequisites
- Before you following this procedure, you need to write a security policy, using the
policytool
command which is included with your Java Development Kit (JDK). This procedure assumes that your policy is located atEAP_HOME/bin/server.policy
. - The domain or standalone server must be completely stopped before you edit any configuration files.
Procedure 10.9. Edit Configuration Files
Open the configuration file.
Open the configuration file for editing. This file is located in one of two places, depending on whether you use a managed domain or standalone server. This is not the executable file used to start the server or domain.Managed Domain
EAP_HOME/bin/domain.conf
Standalone Server
EAP_HOME/bin/standalone.conf
Add the Java options at the end of the file.
Add the following line to a new line at the very end of the file. You can modify the-Djava.security.policy
value to specify the exact location of your security policy. It should go onto one line only, with no line break. You can modify the-Djava.security.debug
to log more or less information, by specifying the debug level. The most verbose isfailure,access,policy
.JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djboss.home.dir=$PWD/.. -Djava.security.policy==$PWD/server.policy -Djava.security.debug=failure"
Start the domain or server.
Start the domain or server as normal.
10.9.3. About Java Security Manager Policies
A set of defined permissions for different classes of code. The Java Security Manager compares actions requested by applications against the security policy. If an action is allowed by the policy, the Security Manager will permit that action to take place. If the action is not allowed by the policy, the Security Manager will deny that action. The security policy can define permissions based on the location of code or on the code's signature.
java.security.manager
and java.security.policy
.
10.9.4. Write a Java Security Manager Policy
An application called policytool
is included with most JDK and JRE distributions, for the purpose of creating and editing Java Security Manager security policies. Detailed information about policytool
is linked from http://docs.oracle.com/javase/6/docs/technotes/tools/.
A security policy consists of the following configuration elements:
- CodeBase
- The URL location (excluding the host and domain information) where the code originates from. This parameter is optional.
- SignedBy
- The alias used in the keystore to reference the signer whose private key was used to sign the code. This can be a single value or a comma-separated list of values. This parameter is optional. If omitted, presence or lack of a signature has no impact on the Java Security Manager.
- Principals
- A list of principal_type/principal_name pairs, which must be present within the executing thread's principal set. The Principals entry is optional. If it is omitted, it signifies "any principals".
- Permissions
- A permission is the access which is granted to the code. Many permissions are provided as part of the Java Enterprise Edition 6 (Java EE 6) specification. This document only covers additional permissions which are provided by JBoss EAP 6.
Procedure 10.10. Setup a new Java Security Manager Policy
Start
policytool
.Start thepolicytool
tool in one of the following ways.Red Hat Enterprise Linux
From your GUI or a command prompt, run/usr/bin/policytool
.Microsoft Windows Server
Runpolicytool.exe
from your Start menu or from thebin\
of your Java installation. The location can vary.
Create a new policy.
To create a new policy, select Add Policy Entry. Add the parameters you need, then click Done.Edit an existing policy
Select the policy from the list of existing policies, and select the Edit Policy Entry button. Edit the parameters as needed.Delete an existing policy.
Select the policy from the list of existing policies, and select the Remove Policy Entry button.
Permission Specific to JBoss EAP 6
- org.jboss.security.SecurityAssociation.getPrincipalInfo
- Provides access to the
org.jboss.security.SecurityAssociation
getPrincipal()
andgetCredential()
methods. The risk involved with using this runtime permission is the ability to see the current thread caller and credentials. - org.jboss.security.SecurityAssociation.getSubject
- Provides access to the
org.jboss.security.SecurityAssociation
getSubject()
method. - org.jboss.security.SecurityAssociation.setPrincipalInfo
- Provides access to the
org.jboss.security.SecurityAssociation
setPrincipal()
,setCredential()
,setSubject()
,pushSubjectContext()
, andpopSubjectContext()
methods. The risk involved with using this runtime permission is the ability to set the current thread caller and credentials. - org.jboss.security.SecurityAssociation.setServer
- Provides access to the
org.jboss.security.SecurityAssociation
setServer()
method. The risk involved with using this runtime permission is the ability to enable or disable multi-thread storage of the caller principal and credential. - org.jboss.security.SecurityAssociation.setRunAsRole
- Provides access to the
org.jboss.security.SecurityAssociation
pushRunAsRole()
,popRunAsRole()
,pushRunAsIdentity()
, andpopRunAsIdentity()
methods. The risk involved with using this runtime permission is the ability to change the current caller run-as role principal. - org.jboss.security.SecurityAssociation.accessContextInfo
- Provides access to the
org.jboss.security.SecurityAssociation
accessContextInfo()
, andaccessContextInfo()
getter and setter methods. This allows you to both set and get the current security context info. - org.jboss.naming.JndiPermission
- Provides special permissions to files and directories in a specified JNDI tree path, or recursively to all files and subdirectories. A JndiPermission consists of a pathname and a set of valid permissions related to the file or directory.The available permissions include:
- bind
- rebind
- unbind
- lookup
- list
- listBindings
- createSubcontext
- all
Pathnames ending in/*
indicate that the specified permissions apply to all files and directories of the pathname. Pathnames ending in/-
indicate recursive permissions to all files and subdirectories of the pathname. Pathnames consisting of the special token <<ALL BINDINGS>> matches any file in any directory. - org.jboss.security.srp.SRPPermission
- A custom permission class for protecting access to sensitive SRP information like the private session key and private key. This permission does not have any actions defined. The
getSessionKey()
target provides access to the private session key which results from the SRP negotiation. Access to this key allows you to encrypt and decrypt messages that have been encrypted with the session key. - org.hibernate.secure.HibernatePermission
- This permission class provides basic permissions to secure Hibernate sessions. The target for this property is the entity name. The available actions include:
- insert
- delete
- update
- read
- * (all)
- org.jboss.metadata.spi.stack.MetaDataStackPermission
- Provides a custom permission class for controlling how callers interact with the metadata stack. The available permissions are:
- modify
- push (onto the stack)
- pop (off the stack)
- peek (onto the stack)
- * (all)
- org.jboss.config.spi.ConfigurationPermission
- Secures setting of configuration properties. Defines only permission target names, and no actions. The targets for this property include:
- <property name> (the property this code has permission to set)
- * (all properties)
- org.jboss.kernel.KernelPermission
- Secures access to the kernel configuration. Defines only permission target names and no actions. The targets for this property include:
- access (to the kernel configuration)
- configure (implies access)
- * (all)
- org.jboss.kernel.plugins.util.KernelLocatorPermission
- Secures access to the kernel. Defines only permission target names and no actions. The targets for this property include:
- kernel
- * (all)
10.9.5. Debug Security Manager Policies
java.security.debug
option configures the level of security-related information reported. The command java -Djava.security.debug=help
will produce help output with the full range of debugging options. Setting the debug level to all
is useful when troubleshooting a security-related failure whose cause is completely unknown, but for general use it will produce too much information. A sensible general default is access:failure
.
Procedure 10.11. Enable general debugging
This procedure will enable a sensible general level of security-related debug information.
Add the following line to the server configuration file.- If the JBoss EAP 6 instance is running in a managed domain, the line is added to the
bin/domain.conf
file for Linux or thebin/domain.conf.bat
file for Windows. - If the JBoss EAP 6 instance is running as a standalone server, the line is added to the
bin/standalone.conf
file for Linux, or thebin\standalone.conf.bat
file for Windows.
Linux
JAVA_OPTS="$JAVA_OPTS -Djava.security.debug=access:failure"
Windows
JAVA_OPTS="%JAVA_OPTS% -Djava.security.debug=access:failure"
A general level of security-related debug information has been enabled.
10.10. Application Security
10.10.1. Enabling/Disabling Descriptor Based Property Replacement
Finite control over descriptor property replacement was introduced in jboss-as-ee_1_1.xsd
. This task covers the steps required to configure descriptor based property replacement.
- When set to
true
, property replacements are enabled. - When set to
false
, property replacements are disabled.
Procedure 10.12. jboss-descriptor-property-replacement
jboss-descriptor-property-replacement
is used to enable or disable property replacement in the following descriptors:
jboss-ejb3.xml
jboss-app.xml
jboss-web.xml
*-jms.xml
*-ds.xml
jboss-descriptor-property-replacement
is true
.
- In the Management CLI, run the following command to determine the value of
jboss-descriptor-property-replacement
:/subsystem=ee:read-attribute(name="jboss-descriptor-property-replacement")
- Run the following command to configure the behavior:
/subsystem=ee:write-attribute(name="jboss-descriptor-property-replacement",value=VALUE)
Procedure 10.13. spec-descriptor-property-replacement
spec-descriptor-property-replacement
is used to enable or disable property replacement in the following descriptors:
ejb-jar.xml
persistence.xml
spec-descriptor-property-replacement
is false
.
- In the Management CLI, run the following command to confirm the value of
spec-descriptor-property-replacement
:/subsystem=ee:read-attribute(name="spec-descriptor-property-replacement")
- Run the following command to configure the behavior:
/subsystem=ee:write-attribute(name="spec-descriptor-property-replacement",value=VALUE)
The descriptor based property replacement tags have been successfully configured.
10.11. SSL Encryption
10.11.1. Implement SSL Encryption for the JBoss EAP 6 Web Server
Many web applications require a SSL-encrypted connection between clients and server, also known as a HTTPS
connection. You can use this procedure to enable HTTPS
on your server or server group.
Prerequisites
- You need a set of SSL encryption keys and a SSL encryption certificate. You may purchase these from a certificate-signing authority, or you can generate them yourself using command-line utilities. To generate encryption keys using Red Hat Enterprise Linux utilities, refer to Section 10.11.2, “Generate a SSL Encryption Key and Certificate”.
- You need to know the following details about your specific environment and set-up:
- The full directory name and path to your certificate files
- The encryption password for your encryption keys.
- You need to run the Management CLI and connect it to your domain controller or standalone server.
Note
/profile=default
from the beginning of any Management CLI commands.
Procedure 10.14. Configure the JBoss Web Server to use HTTPS
Add a new HTTPS connector.
Execute the following Management CLI command, changing the profile as appropriate. This creates a new secure connector, calledHTTPS
, which uses thehttps
scheme, thehttps
socket binding (which defaults to8443
), and is set to be secure.Example 10.25. Management CLI Command
/profile=default/subsystem=web/connector=HTTPS/:add(socket-binding=https,scheme=https,protocol=HTTP/1.1,secure=true)
Configure the SSL encryption certificate and keys.
Execute the following CLI commands to configure your SSL certificate, substituting your own values for the example ones. This example assumes that the keystore is copied to the server configuration directory, which isEAP_HOME/domain/configuration/
for a managed domain.Example 10.26. Management CLI Command
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration:add(name=https,certificate-key-file="${jboss.server.config.dir}/keystore.jks",password=SECRET, key-alias=KEY_ALIAS)
For a full listing of parameters you can set for the SSL properties of the connector, refer to Section 10.11.3, “SSL Connector Reference”.Deploy an application.
Deploy an application to a server group which uses the profile you have configured. If you use a standalone server, deploy an application to your server. HTTP requests to it use the new SSL-encrypted connection.
10.11.2. Generate a SSL Encryption Key and Certificate
Prerequisites
- You need the
keytool
utility, which is provided by any Java Development Kit implementation. OpenJDK on Red Hat Enterprise Linux installs this command to/usr/bin/keytool
. - Understand the syntax and parameters of the
keytool
command. This procedure uses extremely generic instructions, because further discussion of the specifics of SSL certificates or thekeytool
command are out of scope for this documentation.
Procedure 10.15. Generate a SSL Encryption Key and Certificate
Generate a keystore with public and private keys.
Run the following command to generate a keystore namedserver.keystore
with the aliasjboss
in your current directory.keytool -genkeypair -alias jboss -keyalg RSA -keystore server.keystore -storepass mykeystorepass --dname "CN=jsmith,OU=Engineering,O=mycompany.com,L=Raleigh,S=NC,C=US"
The following table describes the parameters used in the keytool command:Parameter Description -genkeypair
The keytool
command to generate a key pair containing a public and private key.-alias
The alias for the keystore. This value is arbitrary, but the alias jboss
is the default used by the JBoss Web server.-keyalg
The key pair generation algorithm. In this case it is RSA
.-keystore
The name and location of the keystore file. The default location is the current directory. The name you choose is arbitrary. In this case, the file will be named server.keystore
.-storepass
This password is used to authenticate to the keystore so that the key can be read. The password must be at least 6 characters long and must be provided when the keystore is accessed. In this case, we used mykeystorepass
. If you omit this parameter, you will be prompted to enter it when you execute the command.-keypass
This is the password for the actual key.Note
Due to an implementation limitation this must be the same as the store password.--dname
A quoted string describing the distinguished name for the key, for example: "CN=jsmith,OU=Engineering,O=mycompany.com,L=Raleigh,C=US". This string is a concatenation of the following components: CN
- The common name or host name. If the hostname is "jsmith.mycompany.com", theCN
is "jsmith".OU
- The organizational unit, for example "Engineering"O
- The organization name, for example "mycompany.com".L
- The locality, for example "Raleigh" or "London"S
- The state or province, for example "NC". This parameter is optional.C
- The 2 letter country code, for example "US" or "UK",
When you execute the above command, you are prompted for the following information:- If you did not use the
-storepass
parameter on the command line, you are asked to enter the keystore password. Re-enter the new password at the next prompt. - If you did not use the
-keypass
parameter on the command line, you are asked to enter the key password. Press Enter to set this to the same value as the keystore password.
When the command completes, the fileserver.keystore
now contains the single key with the aliasjboss
.Verify the key.
Verify that the key works properly by using the following command.keytool -list -keystore server.keystore
You are prompted for the keystore password. The contents of the keystore are displayed (in this case, a single key calledjboss
). Notice the type of thejboss
key, which iskeyEntry
. This indicates that the keystore contains both a public and private entry for this key.Generate a certificate signing request.
Run the following command to generate a certificate signing request using the public key from the keystore you created in step 1.keytool -certreq -keyalg RSA -alias jboss -keystore server.keystore -file certreq.csr
You are prompted for the password in order to authenticate to the keystore. Thekeytool
command then creates a new certificate signing request calledcertreq.csr
in the current working directory.Test the newly generated certificate.
Test the contents of the certificate by using the following command.openssl req -in certreq.csr -noout -text
The certificate details are shown.Optional: Submit your certificate to a Certificate Authority (CA).
A Certificate Authority (CA) can authenticate your certificate so that it is considered trustworthy by third-party clients. The CA supplies you with a signed certificate, and optionally with one or more intermediate certificates.Optional: Export a self-signed certificate from the keystore.
If you only need it for testing or internal purposes, you can use a self-signed certificate. You can export one from the keystore you created in step 1 as follows:keytool -export -alias jboss -keystore server.keystore -file server.crt
You are prompted for the password in order to authenticate to the keystore. A self-signed certificate, namedserver.crt
, is created in the current working directory.Import the signed certificate, along with any intermediate certificates.
Import each certificate, in the order that you are instructed by the CA. For each certificate to import, replaceintermediate.ca
orserver.crt
with the actual file name. If your certificates are not provided as separate files, create a separate file for each certificate, and paste its contents into the file.Note
Your signed certificate and certificate keys are valuable assets. Be cautious with how you transport them between servers.keytool -import -keystore server.keystore -alias intermediateCA -file intermediate.ca
keytool -import -alias jboss -keystore server.keystore -file server.crt
Test that your certificates imported successfully.
Run the following command, and enter the keystore password when prompted. The contents of your keystore are displayed, and the certificates are part of the list.keytool -list -keystore server.keystore
Your signed certificate is now included in your keystore and is ready to be used to encrypt SSL connections, including HTTPS web server communications.
10.11.3. SSL Connector Reference
default
. Change the profile name to the one you wish to configure, for a managed domain, or omit the /profile=default
portion of the command, for a standalone server.
Table 10.3. SSL Connector Attributes
Attribute | Description | CLI Command |
---|---|---|
Name |
The display name of the SSL connector.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=name,value=https) |
verify-client |
Set to
true to require a valid certificate chain from the client before accepting a connection. Set to want if you want the SSL stack to request a client Certificate, but not fail if one is not presented. Set to false (the default) to not require a certificate chain unless the client requests a resource protected by a security constraint that uses CLIENT-CERT authentication.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=verify-client,value=want) |
verify-depth |
The maximum number of intermediate certificate issuers checked before deciding that the clients do not have a valid certificate. The default value is
10 .
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=verify-depth,value=10) |
certificate-key-file |
The full file path and file name of the keystore file where the signed server certificate is stored. With JSSE encryption, this certificate file will be the only one, while OpenSSL uses several files. The default value is the
.keystore file in the home directory of the user running JBoss EAP 6. If your keystoreType does not use a file, set the parameter to an empty string.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-key-file,value=../domain/configuration/server.keystore) |
certificate-file |
If you use OpenSSL encryption, set the value of this parameter to the path to the file containing the server certificate.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-file,value=server.crt) |
password |
The password for both the trustore and keystore. In the following example, replace PASSWORD with your own password.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=password,value=PASSWORD) |
protocol |
The version of the SSL protocol to use. Supported values include
SLv2 , SSLv3 , TLSv1 , SSLv2+SSLv3 , and ALL . The default is ALL .
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=protocol,value=ALL) |
cipher-suite |
A comma-separated list of the encryption ciphers which are allowed. The JVM default for JSSE contains weak ciphers which should not be used. The example only lists two possible ciphers, but real-world examples will likely use more.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=cipher-suite, value="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA") |
key-alias |
The alias used to for the server certificate in the keystore. In the following example, replace KEY_ALIAS with your certificate's alias.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=key-alias,value=KEY_ALIAS) |
truststore-type |
The type of the truststore. Various types of keystores are available, including
PKCS12 and Java's standard JKS .
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=truststore-type,value=jks) |
keystore-type |
The type of the keystore, Various types of keystores are available, including
PKCS12 and Java's standard JKS .
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=keystore-type,value=jks) |
ca-certificate-file |
The file containing the CA certificates. This is the
truststoreFile , in the case of JSSE, and uses the same password as the keystore. The ca-certificate-file file is used to validate client certificates.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-file,value=ca.crt) |
ca-certificate-password |
The Certificate password for the
ca-certificate-file . In the following example, replace the MASKED_PASSWORD with your own masked password.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=ca-certificate-password,value=MASKED_PASSWORD) |
ca-revocation-url |
A file or URL which contains the revocation list. It refers to the
crlFile for JSSE or the SSLCARevocationFile for SSL.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=ca-revocation-url,value=ca.crl) |
session-cache-size |
The size of the SSLSession cache. This attribute applies only to JSSE connectors. The default is
0 , which specifies an unlimited cache size.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=session-cache-size,value=100) |
session-timeout |
The number of seconds before a cached SSLSession expires. This attribute applies only to JSSE connectors. The default is
86400 seconds, which is 24 hours.
|
/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=session-timeout,value=43200) |
10.12. Password Vaults for Sensitive Strings
10.12.1. About Securing Sensitive Strings in Clear-Text Files
10.12.2. Create a Java Keystore to Store Sensitive Strings
Prerequisites
- The
keytool
command must be available to use. It is provided by the Java Runtime Environment (JRE). Locate the path for the file. In Red Hat Enterprise Linux, it is installed to/usr/bin/keytool
.
Procedure 10.16. Setup a Java Keystore
Create a directory to store your keystore and other encrypted information.
Create a directory to hold your keystore and other important information. The rest of this procedure assumes that the directory is/home/USER/vault/
.Determine the parameters to use with
keytool
.Determine the following parameters:- alias
- The alias is a unique identifier for the vault or other data stored in the keystore. The alias in the example command at the end of this procedure is
vault
. Aliases are case-insensitive. - keyalg
- The algorithm to use for encryption. The default is
DSA
. The example in this procedure usesRSA
. Check the documentation for your JRE and operating system to see which other choices may be available to you. - keysize
- The size of an encryption key impacts how difficult it is to decrypt through brute force. The default size of keys is 1024. It must be between 512 and 2048, and a multiple of 64. The example in this procedure uses
2048
. - keystore
- The keystore is a database which holds encrypted information and the information about how to decrypt it. If you do not specify a keystore, the default keystore to use is a file called
.keystore
in your home directory. The first time you add data to a keystore, it is created. The example in this procedure uses thevault.keystore
keystore.
Thekeytool
command has many other options. Refer to the documentation for your JRE or your operating system for more details.Determine the answers to questions the
keystore
command will ask.Thekeystore
needs the following information in order to populate the keystore entry:- Keystore password
- When you create a keystore, you must set a password. In order to work with the keystore in the future, you need to provide the password. Create a strong password that you will remember. The keystore is only as secure as its password and the security of the file system and operating system where it resides.
- Key password (optional)
- In addition to the keystore password, you can specify a password for each key it holds. In order to use such a key, the password needs to be given each time it is used. Usually, this facility is not used.
- First name (given name) and last name (surname)
- This, and the rest of the information in the list, helps to uniquely identify the key and place it into a hierarchy of other keys. It does not necessarily need to be a name at all, but it should be two words, and must be unique to the key. The example in this procedure uses
Accounting Administrator
. In directory terms, this becomes the common name of the certificate. - Organizational unit
- This is a single word that identifies who uses the certificate. It may be the application or the business unit. The example in this procedure uses
AccountingServices
. Typically, all keystores used by a group or application use the same organizational unit. - Organization
- This is usually a single-word representation of your organization's name. This typically remains the same across all certificates used by an organization. This example uses
MyOrganization
. - City or municipality
- Your city.
- State or province
- Your state or province, or the equivalent for your locality.
- Country
- The two-letter code for your country.
All of this information together will create a hierarchy for your keystores and certificates, ensuring that they use a consistent naming structure but are unique.Run the
keytool
command, supplying the information that you gathered.Example 10.27. Example input and output of
keystore
command$ keytool -genkey -alias vault -keyalg RSA -keysize 2048 -keystore /home/USER/vault/vault.keystore Enter keystore password: vault22 Re-enter new password:vault22 What is your first and last name? [Unknown]:
Accounting Administrator
What is the name of your organizational unit? [Unknown]:AccountingServices
What is the name of your organization? [Unknown]:MyOrganization
What is the name of your City or Locality? [Unknown]:Raleigh
What is the name of your State or Province? [Unknown]:NC
What is the two-letter country code for this unit? [Unknown]:US
Is CN=Accounting Administrator, OU=AccountingServices, O=MyOrganization, L=Raleigh, ST=NC, C=US correct? [no]:yes
Enter key password for <vault> (RETURN if same as keystore password):
A file named vault.keystore
is created in the /home/USER/vault/
directory. It stores a single key, called vault
, which will be used to store encrypted strings, such as passwords, for JBoss EAP 6.
10.12.3. Mask the Keystore Password and Initialize the Password Vault
Prerequisites
- The
EAP_HOME/bin/vault.sh
application needs to be accessible via a command-line interface.
Run the
vault.sh
command.RunEAP_HOME/bin/vault.sh
. Start a new interactive session by typing0
.Enter the directory where encrypted files will be stored.
This directory should be reasonably secure, but JBoss EAP 6 needs to be able to access it. If you followed Section 10.12.2, “Create a Java Keystore to Store Sensitive Strings”, your keystore is in a directory calledvault/
in your home directory. This example uses the directory/home/USER/vault/
.Note
Do not forget to include the trailing slash on the directory name. Either use/
or\
, depending on your operating system.Enter the path to the keystore.
Enter the full path to the keystore file. This example uses/home/USER/vault/vault.keystore
.Encrypt the keystore password.
The following steps encrypt the keystore password, so that you can use it in configuration files and applications securely.Enter the keystore password.
When prompted, enter the keystore password.Enter a salt value.
Enter an 8-character salt value. The salt value, together with the iteration count (below), are used to create the hash value.Enter the iteration count.
Enter a number for the iteration count.Make a note of the masked password information.
The masked password, the salt, and the iteration count are printed to standard output. Make a note of them in a secure location. An attacker could use them to decrypt the password.Enter the alias of the vault.
When prompted, enter the alias of the vault. If you followed Section 10.12.2, “Create a Java Keystore to Store Sensitive Strings” to create your vault, the alias isvault
.
Exit the interactive console.
Type2
to exit the interactive console.
Your keystore password has been masked for use in configuration files and deployments. In addition, your vault is fully configured and ready to use.
10.12.4. Configure JBoss EAP 6 to Use the Password Vault
Before you can mask passwords and other sensitive attributes in configuration files, you need to make JBoss EAP 6 aware of the password vault which stores and decrypts them. Follow this procedure to enable this functionality.
Prerequisites
Procedure 10.17. Setup a Password Vault
Determine the correct values for the command.
Determine the values for the following parameters, which are determined by the commands used to create the keystore itself. For information on creating a keystore, refer to the following topics: Section 10.12.2, “Create a Java Keystore to Store Sensitive Strings” and Section 10.12.3, “Mask the Keystore Password and Initialize the Password Vault”.Parameter Description KEYSTORE_URL The file system path or URI of the keystore file, usually called something likevault.keystore
KEYSTORE_PASSWORD The password used to access the keystore. This value should be masked.KEYSTORE_ALIAS The name of the keystore.SALT The salt used to encrypt and decrypt keystore values.ITERATION_COUNT The number of times the encryption algorithm is run.ENC_FILE_DIR The path to the directory from which the keystore commands are run. Typically the directory containing the password vault.host (managed domain only) The name of the host you are configuringUse the Management CLI to enable the password vault.
Run one of the following commands, depending on whether you use a managed domain or standalone server configuration. Substitute the values in the command with the ones from the first step of this procedure.Note
If you use Microsoft Windows Server, replace each/
character in a filename or directory path with four\
characters. This is because it should be two\
characters, each escaped. This does not need to be done for other/
characters.Managed Domain
/host=YOUR_HOST/core-service=vault:add(vault-options=[("KEYSTORE_URL" => "PATH_TO_KEYSTORE"), ("KEYSTORE_PASSWORD" => "MASKED_PASSWORD"), ("KEYSTORE_ALIAS" => "ALIAS"), ("SALT" => "SALT"),("ITERATION_COUNT" => "ITERATION_COUNT"), ("ENC_FILE_DIR" => "ENC_FILE_DIR")])
Standalone Server
/core-service=vault:add(vault-options=[("KEYSTORE_URL" => "PATH_TO_KEYSTORE"), ("KEYSTORE_PASSWORD" => "MASKED_PASSWORD"), ("KEYSTORE_ALIAS" => "ALIAS"), ("SALT" => "SALT"),("ITERATION_COUNT" => "ITERATION_COUNT"), ("ENC_FILE_DIR" => "ENC_FILE_DIR")])
The following is an example of the command with hypothetical values:/core-service=vault:add(vault-options=[("KEYSTORE_URL" => "/home/user/vault/vault.keystore"), ("KEYSTORE_PASSWORD" => "MASK-3y28rCZlcKR"), ("KEYSTORE_ALIAS" => "vault"), ("SALT" => "12438567"),("ITERATION_COUNT" => "50"), ("ENC_FILE_DIR" => "/home/user/vault/")])
JBoss EAP 6 is configured to decrypt masked strings using the password vault. To add strings to the vault and use them in your configuration, refer to the following topic: Section 10.12.5, “Store and Retrieve Encrypted Sensitive Strings in the Java Keystore”.
10.12.5. Store and Retrieve Encrypted Sensitive Strings in the Java Keystore
Including passwords and other sensitive strings in plain-text configuration files is insecure. JBoss EAP 6 includes the ability to store and mask these sensitive strings in an encrypted keystore, and use masked values in configuration files.
Prerequisites
- The
EAP_HOME/bin/vault.sh
application needs to be accessible via a command-line interface.
Procedure 10.18. Setup the Java Keystore
Run the
vault.sh
command.RunEAP_HOME/bin/vault.sh
. Start a new interactive session by typing0
.Enter the directory where encrypted files will be stored.
If you followed Section 10.12.2, “Create a Java Keystore to Store Sensitive Strings”, your keystore is in a directory calledvault/
in your home directory. In most cases, it makes sense to store all of your encrypted information in the same place as the key store. This example uses the directory/home/USER/vault/
.Note
Do not forget to include the trailing slash on the directory name. Either use/
or\
, depending on your operating system.Enter the path to the keystore.
Enter the full path to the keystore file. This example uses/home/USER/vault/vault.keystore
.Enter the keystore password, vault name, salt, and iteration count.
When prompted, enter the keystore password, vault name, salt, and iteration count. A handshake is performed.Select the option to store a password.
Select option0
to store a password or other sensitive string.Enter the value.
When prompted, enter the value twice. If the values do not match, you are prompted to try again.Enter the vault block.
Enter the vault block, which is a container for attributes which pertain to the same resource. An example of an attribute name would beds_ExampleDS
. This will form part of the reference to the encrypted string, in your datasource or other service definition.Enter the attribute name.
Enter the name of the attribute you are storing. An example attribute name would bepassword
.ResultA message such as the one below shows that the attribute has been saved.
Attribute Value for (ds_ExampleDS, password) saved
Make note of the information about the encrypted string.
A message prints to standard output, showing the vault block, attribute name, shared key, and advice about using the string in your configuration. Make note of this information in a secure location. Example output is shown below.******************************************** Vault Block:ds_ExampleDS Attribute Name:password Shared Key:N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0 Configuration should be done as follows: VAULT::ds_ExampleDS::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0 ********************************************
Use the encrypted string in your configuration.
Use the string from the previous step in your configuration, in place of a plain-text string. A datasource using the encrypted password above is shown below.... <subsystem xmlns="urn:jboss:domain:datasources:1.0"> <datasources> <datasource jndi-name="java:jboss/datasources/ExampleDS" enabled="true" use-java-context="true" pool-name="H2DS"> <connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <pool></pool> <security> <user-name>sa</user-name> <password>${VAULT::ds_ExampleDS::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}</password> </security> </datasource> <drivers> <driver name="h2" module="com.h2database.h2"> <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class> </driver> </drivers> </datasources> </subsystem> ...
You can use an encrypted string anywhere in your domain or standalone configuration file where expressions are allowed.Note
To check if expressions are allowed within a particular subsystem, run the following CLI command against that subsystem:/host=master/core-service=management/security-realm=TestRealm:read-resource-description(recursive=true)
From the output of running this command, look for the value for theexpressions-allowed
parameter. If this is true, then you can use expressions within the configuration of this particular subsystem.After you store your string in the keystore, use the following syntax to replace any clear-text string with an encrypted one.${VAULT::<replaceable>VAULT_BLOCK</replaceable>::<replaceable>ATTRIBUTE_NAME</replaceable>::<replaceable>ENCRYPTED_VALUE</replaceable>}
Here is a sample real-world value, where the vault block isds_ExampleDS
and the attribute ispassword
.<password>${VAULT::ds_ExampleDS::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}</password>
10.12.6. Store and Resolve Sensitive Strings In Your Applications
Configuration elements of JBoss EAP 6 support the ability to resolve encrypted strings against values stored in a Java Keystore, via the Security Vault mechanism. You can add support for this feature to your own applications.
Before performing this procedure, make sure that the directory for storing your vault files exists. It does not matter where you place them, as long as the user who executes JBoss EAP 6 has permission to read and write the files. This example places the vault/
directory into the /home/USER/vault/
directory. The vault itself is a file called vault.keystore
inside the vault/
directory.
Example 10.28. Adding the Password String to the Vault
EAP_HOME/bin/vault.sh
command. The full series of commands and responses is included in the following screen output. Values entered by the user are emphasized. Some output is removed for formatting. In Microsoft Windows, the name of the command is vault.bat
. Note that in Microsoft Windows, file paths use the \
character as a directory separator, rather than the /
character.
[user@host bin]$ ./vault.sh ********************************** **** JBoss Vault ******** ********************************** Please enter a Digit:: 0: Start Interactive Session 1: Remove Interactive Session 2: Exit0
Starting an interactive session Enter directory to store encrypted files:/home/user/vault/
Enter Keystore URL:/home/user/vault/vault.keystore
Enter Keystore password:...
Enter Keystore password again:...
Values match Enter 8 character salt:12345678
Enter iteration count as a number (Eg: 44):25
Enter Keystore Alias:vault
Vault is initialized and ready for use Handshake with Vault complete Please enter a Digit:: 0: Store a password 1: Check whether password exists 2: Exit0
Task: Store a password Please enter attribute value:sa
Please enter attribute value again:sa
Values match Enter Vault Block:DS
Enter Attribute Name:thePass
Attribute Value for (DS, thePass) saved Please make note of the following: ******************************************** Vault Block:DS Attribute Name:thePass Shared Key:OWY5M2I5NzctYzdkOS00MmZhLWExZGYtNjczM2U5ZGUyOWIxTElORV9CUkVBS3ZhdWx0 Configuration should be done as follows: VAULT::DS::thePass::OWY5M2I5NzctYzdkOS00MmZhLWExZGYtNjczM2U5ZGUyOWIxTElORV9CUkVBS3ZhdWx0 ******************************************** Please enter a Digit:: 0: Store a password 1: Check whether password exists 2: Exit2
VAULT
.
Example 10.29. Servlet Using a Vaulted Password
package vaulterror.web; import java.io.IOException; import java.io.Writer; import javax.annotation.Resource; import javax.annotation.sql.DataSourceDefinition; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.sql.DataSource; /*@DataSourceDefinition( name = "java:jboss/datasources/LoginDS", user = "sa", password = "sa", className = "org.h2.jdbcx.JdbcDataSource", url = "jdbc:h2:tcp://localhost/mem:test" )*/ @DataSourceDefinition( name = "java:jboss/datasources/LoginDS", user = "sa", password = "VAULT::DS::thePass::OWY5M2I5NzctYzdkOS00MmZhLWExZGYtNjczM2U5ZGUyOWIxTElORV9CUkVBS3ZhdWx0", className = "org.h2.jdbcx.JdbcDataSource", url = "jdbc:h2:tcp://localhost/mem:test" ) @WebServlet(name = "MyTestServlet", urlPatterns = { "/my/" }, loadOnStartup = 1) public class MyTestServlet extends HttpServlet { private static final long serialVersionUID = 1L; @Resource(lookup = "java:jboss/datasources/LoginDS") private DataSource ds; @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { Writer writer = resp.getWriter(); writer.write((ds != null) + ""); } }
10.13. FIPS 140-2 Compliant Encryption
10.13.1. About FIPS 140-2 Compliance
10.13.2. FIPS 140-2 Compliant Passwords
- Must be at least seven (7) characters in length.
- Must include characters from at least three (3) of the following character classes:
- ASCII digits,
- lowercase ASCII,
- uppercase ASCII,
- non-alphanumeric ASCII, and
- non-ASCII.
10.13.3. Enable FIPS 140-2 Cryptography for SSL on Red Hat Enterprise Linux 6
Prerequisites
- Red Hat Enterprise Linux 6 must already be configured to be FIPS 140-2 compliant. Refer to https://access.redhat.com/knowledge/solutions/137833.
Procedure 10.19. Enable FIPS 140-2 Compliant Cryptography for SSL
Create the database
Create the NSS database in a directory own by thejboss
user.$ mkdir -p /usr/share/jboss-as/nssdb $ chown jboss /usr/share/jboss-as/nssdb $ modutil -create -dbdir /usr/share/jboss-as/nssdb
Create NSS configuration file
Create a new text file with the namenss_pkcsll_fips.cfg
in the/usr/share/jboss-as
directory with the following contents:name = nss-fips nssLibraryDirectory=/usr/lib64 nssSecmodDirectory=/usr/share/jboss-as/nssdb nssModule = fips
The NSS configuration file must specify:- a name,
- the directory where the NSS library is located, and
- the directory where the NSS database was created as per step 1.
If you are not running a 64bit version of Red Hat Enterprise Linux 6 then setnssLibraryDirectory
to/usr/lib
instead of/usr/lib64
.Enable SunPKCS11 provider
Edit thejava.security
configuration file for your JRE ($JAVA_HOME/jre/lib/security/java.security
) and add the following line:security.provider.1=sun.security.pkcs11.SunPKCS11 /usr/share/jboss-as/nss_pkcsll_fips.cfg
Note that the configuration file specified in this line is the file created in step 2.Any othersecurity.provider.X
lines in this file must have the value of their X increased by one to ensure that this provider is given priority.Enable FIPS mode for the NSS library
Run themodutil
command as shown to enable FIPS mode:modutil -fips true -dbdir /usr/share/jboss-as/nssdb
Note that the directory specified here is the one created in step 1.You may get a security library error at this point requiring you to regenerate the library signatures for some of the NSS shared objects.Change the password on the FIPS token
Set the password on the FIPS token using the following command. Note that the name of the token must beNSS FIPS 140-2 Certificate DB
.modutil -changepw "
NSS FIPS 140-2 Certificate DB
" -dbdir /usr/share/jboss-as/nssdbThe password used for the FIPS token must be a FIPS compliant password.Create certificate using NSS tools
Enter the following command to create a certificate using the NSS tools.certutil -S -k rsa -n jbossweb -t "u,u,u" -x -s "CN=localhost, OU=MYOU, O=MYORG, L=MYCITY, ST=MYSTATE, C=MY" -d /usr/share/jboss-as/nssdb
Configure the HTTPS connector to use the PKCS11 keystore
Add a HTTPS connector using the following command in the JBoss CLI Tool:/subsystem=web/connector=https/:add(socket-binding=https,scheme=https,protocol=HTTP/1.1,secure=true)
Then add the SSL configuration with the following command, replacing PASSWORD with the FIPS compliant password from step 5./subsystem=web/connector=https/ssl=configuration:add(name=https,password=PASSWORD,keystore-type=PCKS11, cipher-suite="SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_anon_WITH_AES_128_CBC_SHA, TLS_ECDH_anon_WITH_AES_256_CBC_SHA")
Verify
Verify that the JVM can read the private key from the PKCS11 keystore by running the following command:keytool -list -storetype pkcs11
Example 10.30. XML configuration for HTTPS connector using FIPS 140-2 compliance
<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"> <ssl name="https" password="****" cipher-suite="SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_anon_WITH_AES_128_CBC_SHA, TLS_ECDH_anon_WITH_AES_256_CBC_SHA" keystore-type="PKCS11"/> </connector>
cipher-suite
attribute has linebreaks inserted to make it easier to read.
Chapter 11. Security Administration Reference
11.1. Included Authentication Modules
Role
within the Code
name.
Code
value or the full (package qualified) name to refer to the module.jaa
Authentication Modules
Table 11.1. Client
Code | Client
|
Class | org.jboss.security.ClientLoginModule
|
Description |
This login module is designed to establish caller identity and credentials when JBoss EAP 6 is acting as a client. It should never be used as part of a security domain used for actual server authentication.
|
Table 11.2. Client Module Options
Option | Type | Default | Description |
---|---|---|---|
multi-threaded | true or false
| false
|
Set to true if each thread has its own principal and credential storage. Set to false to indicate that all threads in the VM share the same identity and credential.
|
password-stacking
| useFirstPass or false
| false
|
Set to useFirstPass to indicate that this login module should look for information stored in the LoginContext to use as the identity. This option can be used when stacking other login modules with this one.
|
restore-login-identity
| true or false
| false
|
Set to true if the identity and credential seen at the start of the login() method should be restored after the logout() method is invoked.
|
Table 11.3. Certificate
Code | Certificate
|
Class | org.jboss.security.auth.spi.BaseCertLoginModule
|
Description |
This login module is designed to authenticate users based on
X509 Certificates . A use case for this is CLIENT-CERT authentication of a web application.
|
Table 11.4. Certificate
Module Options
Option | Type | Default | Description |
---|---|---|---|
securityDomain
| string |
none
|
Name of the security domain that has the JSSE configuration for the truststore holding the trusted certificates.
|
verifier
| Class |
none
|
The class name of the
org.jboss.security.auth.certs.X509CertificateVerifier to use for verification of the login certificate.
|
Table 11.5. CertificateUsers
Code | CertificateUsers
|
Class | org.jboss.security.auth.spi.UsersRolesLoginModule
|
Description |
Uses a properties resources. The first maps usernames to passwords, and the second maps usernames to roles.
|
Table 11.6. CertificateUsers
Module Options
Option | Type | Default | Description |
---|---|---|---|
unauthenticatedIdentity
| A string |
none
|
Defines the principal name that should be assigned to requests which contain no authentication information. This can allow unprotected servlets to invoke methods on EJBs that do not require a specific role. Such a principal has no associated roles and can only access either unsecured EJBs or EJB methods that are associated with the
unchecked permission constraint.
|
password-stacking
| useFirstPass or false
| false
|
Set to
useFirstPass to indicate that this login module should look for information stored in the LoginContext to use as the identity. This option can be used when stacking other login modules with this one.
|
hashAlgorithm | A string |
none
|
The name of the
java.security.MessageDigest algorithm to use to hash the password. There is no default so this option must be explicitly set to enable hashing. When hashAlgorithm is specified, the clear text password obtained from the CallbackHandler is hashed before it is passed to UsernamePasswordLoginModule.validatePassword as the inputPassword argument. The expectedPassword stored in the users.properties file must be comparably hashed. Refer to http://docs.oracle.com/javase/6/docs/api/java/security/MessageDigest.html for information on java.security.MessageDigest and the algorithms this class supports.
|
hashEncoding
| base64 or hex
| base64
|
The string format for the hashed password, if
hashAlgorithm is also set.
|
hashCharset
| A string |
The default encoding set in the container's environment.
|
The encoding used to convert the clear-text password to a byte array.
|
usersProperties
|
The fully-qualified file path and name of a properties file or resource
| users.properties
|
The file containing the mappings between users and passwords. Each property in the file has the format
username=password .
|
rolesProperties
| The fully-qualified file path and name of a properties file or resource | roles.properties
|
The file containing the mappings between users and roles. Each property in the file has the format
username=role1,role2,...,roleN .
|
ignorePasswordCase
| true or false
| false
|
Whether the password comparison should ignore case. This is useful for hashed password encoding where the case of the hashed password is not significant.
|
principalClass
| A fully-qualified classname. |
none
|
A
Principal implementation class which contains a constructor that takes a String argument for the princpal name.
|
roleGroupSeparator
|
A single character
| . (a single period)
|
The character used to seperate the username from the role group name in the
rolesGroup file.
|
defaultUsersProperties
| string | defaultUsers.properties
|
Name of the resource or file to fall back to if the usersProperties file can't be found.
|
defaultRolesProperties
| string | defaultRoles.properties
|
Name of the resource or file to fall back to if the
rolesProperties file cannot be found.
|
hashUserPassword
| true or false
| true
|
Whether to hash the password entered by the user, when
hashAlgorithm is specified. Defaults to true .
|
hashStorePassword
| true or false
| true
|
Whether the store password returned from
getUsersPassword() should be hashed, when hashAlgorithm is specified.
|
digestCallback
| A fully-qualified classname. |
none
|
The class name of the
org.jboss.crypto.digest.DigestCallback implementation that includes pre or post digest content such as salt values. Only used if hashAlgorithm is specified.
|
storeDigestCallback
| A fully-qualified classname. |
none
|
The class name of the
org.jboss.crypto.digest.DigestCallback implementation that includes pre/post digest content like salts for hashing the store password. Only used if hashStorePassword is true and hashAlgorithm is specified.
|
callback.option.STRING
| Various | none |
All options prefixed with
callback.option. are passed to the DigestCallback.init(Map) method. The input username is always passed in via the javax.security.auth.login.name option, and the input/store password is passed in via the javax.security.auth.login.password option to the digestCallback or storeDigestCallback .
|
Table 11.7. CertificateRoles
Code | CertificateRoles
|
Class | org.jboss.security.auth.spi.CertRolesLoginModule
|
Description |
This login module extends the Certificate login module to add role mapping capabilities from a properties file. It takes all of the same options as the Certificate login module, and adds the following options.
|
Table 11.8. CertificateRoles
Module Options
Option | Type | Default | Description |
---|---|---|---|
rolesProperties
| A string | roles.properties
|
The name of the resource or file containing the roles to assign to each user. The role properties file must be in the format username=role1,role2 where the username is the DN of the certificate, escaping any
= (equals) and space characters. The following example is in the correct format:
CN\=unit-tests-client,\ OU\=Red\ Hat\ Inc.,\ O\=Red\ Hat\ Inc.,\ ST\=North\ Carolina,\ C\=US=JBossAdmin |
defaultRolesProperties
| A string | defaultRoles.properties
|
Name of the resource or file to fall back to if the
rolesProperties file cannot be found.
|
roleGroupSeparator
| A single character | . (a single period)
|
Which character to use as the role group separator in the
roleProperties file.
|
Table 11.9. Database
Code | Database |
Class | org.jboss.security.auth.spi.DatabaseServerLoginModule
|
Description |
A JDBC-based login module that supports authentication and role mapping. It is based on two logical tables, with the following definitions.
|
Table 11.10. Database
Module Options
Option | Type | Default | Description |
---|---|---|---|
dsJndiName
| A JNDI resource |
none
|
The name of the JNDI resource storing the authentication information. This option is required.
|
principalsQuery
| A prepared SQL statement | select Password from Principals where PrincipalID=?
|
The prepared SQL query to obtain the information about the principal.
|
rolesQuery
| A prepared SQL statement | select Role, RoleGroup from Roles where PrincipalID=?
|
The prepared SQL query to obtain the information about the roles. It should be equivalent to
select Role, RoleGroup from Roles where PrincipalID=? , where Role is the role name and the RoleGroup column value should always be either Roles with a capital R or CallerPrincipal .
|
Table 11.11. DatabaseCertificate
Code | DatabaseCertificate
|
Class | org.jboss.security.auth.spi.DatabaseCertLoginModule
|
Description |
This login module extends the Certificate login module to add role mapping capabilities from a database table. It has the same options plus these additional options:
|
Table 11.12. DatabaseCertificate
Module Options
Option | Type | Default | Description |
---|---|---|---|
dsJndiName
| A JNDI resource |
|
The name of the JNDI resource storing the authentication information. This option is required.
|
rolesQuery
| A prepared SQL statement | select Role,RoleGroup from Roles where PrincipalID=?
|
SQL prepared statement to be executed in order to map roles. It should be an equivalent to
select Role, RoleGroup from Roles where PrincipalID=? , where Role is the role name and the RoleGroup column value should always be either Roles with a capital R or CallerPrincipal .
|
suspendResume
| true or false
| true
|
Whether any existing JTA transaction should be suspended during database operations.
|
Table 11.13. Identity
Code | Identity
|
Class | org.jboss.security.auth.spi.IdentityLoginModule
|
Description |
Associates the principal specified in the module options with any subject authenticated against the module. The type of Principal class used is
org.jboss.security.SimplePrincipal. . If no principal option is specified a principal with the name of guest is used.
|
Table 11.14. Identity
Module Options
Option | Type | Default | Description |
---|---|---|---|
principal
| A string | guest
|
The name to use for the principal.
|
roles
| A comma-separated list of strings |
none
|
A comma-delimited list of roles which will be assigned to the subject.
|
Table 11.15. Ldap
Code | Ldap
|
Class | org.jboss.security.auth.spi.LdapLoginModule
|
Description |
Authenticates against an LDAP server, when the username and password are stored in an LDAP server that is accessible using a JNDI LDAP provider. Many of the options are not required, because they are determined by the LDAP provider or the environment.
|
Table 11.16. Ldap
Module Options
Option | Type | Default | Description |
---|---|---|---|
java.naming.factory.initial
| class name | com.sun.jndi.ldap.LdapCtxFactory
| InitialContextFactory implementation class name.
|
java.naming.provider.url
| ldap:// URL
|
none
|
URL for the LDAP server.
|
java.naming.security.authentication
| none , simple , or the name of a SASL mechanism
| simple
|
The security level to use to bind to the LDAP server.
|
java.naming.security.protocol
| A transport protocol |
If unspecified, determined by the provider.
|
The transport protocol to use for secure access, such as SSL.
|
java.naming.security.principal
| A string |
none
|
The name of the principal for authenticating the caller to the service. This is built from other properties described below.
|
java.naming.security.credentials
| A credential type |
none
|
The type of credential used by the authentication scheme. Some examples include hashed password, clear-text password, key, or certificate. If this property is unspecified, the behavior is determined by the service provider.
|
principalDNPrefix
| A string |
none
|
Prefix added to the username to form the user DN. You can prompt the user for a username and build the fully-qualified DN by using the
principalDNPrefix and principalDNSuffix .
|
principalDNSuffix
| string |
|
Suffix added to the username to form the user DN. You can prompt the user for a username and build the fully-qualified DN by using the
principalDNPrefix and principalDNSuffix .
|
useObjectCredential
| true or false
|
false
|
Whether the credential should be obtained as an opaque Object using the
org.jboss.security.auth.callback.ObjectCallback type of Callback rather than as a char[] password using a JAAS PasswordCallback. This allows for passing non-char[] credential information to the LDAP server.
|
rolesCtxDN
| A fully-qualified DN |
none
|
The fully-qualified DN for the context to search for user roles.
|
userRolesCtxDNAttributeName
|
An attribute
|
none
|
The attribute in the user object that contains the DN for the context to search for user roles. This differs from
rolesCtxDN in that the context to search for a user's roles may be unique for each user.
|
roleAttributeID
| An attribute | roles
|
Name of the attribute containing the user roles.
|
roleAttributeIsDN
| true or false
| false
|
Whether or not the
roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true .
|
roleNameAttributeID
| An attribute | group
|
Name of the attribute within the
roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true , this property is used to find the role object's name attribute.
|
uidAttributeID
| An attribute | uid
|
Name of the attribute in the
UserRolesAttributeDN that corresponds to the user ID. This is used to locate the user roles.
|
matchOnUserDN
| true or false
| false
|
Whether or not the search for user roles should match on the user's fully distinguished DN or the username only. If
true , the full user DN is used as the match value. If false , only the username is used as the match value against the uidAttributeName attribute.
|
allowEmptyPasswords
| true or false
| true
|
Whether to allow empty passwords. Most LDAP servers treat empty passwords as anonymous login attempts. To reject empty passwords, set this to false.
|
Table 11.17. LdapExtended
Code | LdapExtended
|
Class | org.jboss.security.auth.spi.LdapExtLoginModule
|
Description |
An alternate LDAP login module implementation that uses searches to locate the bind user and associated roles. The roles query recursively follows DNs to navigate a hierarchical role structure. It uses the same
java.naming options as the Ldap module, and uses the following options instead of the other options of the Ldap module.
The authentication happens in 2 steps:
|
Table 11.18. LdapExtended
Module Options
Option | Type | Default | Description |
---|---|---|---|
baseCtxDN
| A fully-qualified DN |
none
|
The fixed DN of the top-level context to begin the user search.
|
bindDN
| A fully-qualified DN |
none
|
The DN used to bind against the LDAP server for the user and roles queries. This DN needs read and search permissions on the
baseCtxDN and rolesCtxDN values.
|
bindCredential
| A string, optionally encrypted |
none
|
The password for the
bindDN . This can be encrypted using the vault mechanism. Refer to the following topic to read more about encrypting sensitive strings: Section 10.12.2, “Create a Java Keystore to Store Sensitive Strings”
|
baseFilter
| LDAP filter string |
none
|
A search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a
{0} expression is used. A common example for the search filter is (uid={0}) .
|
rolesCtxDN
| fully-qualified DN |
none
|
The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.
|
roleFilter
| LDAP filter string |
|
A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a
{0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}) . An alternative that matches on the authenticated userDN is (member={1}) .
|
roleAttributeIsDN | true or false
| false
|
Whether or not the
roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true .
|
defaultRole
|
Role name
|
none
|
A role included for all authenticated users
|
parseRoleNameFromDN
| true or false
| false
|
A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to
true , the DN is checked for the roleNameATtributeID. If set to false , the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.
|
parseUsername
| true or false
| false
|
A flag indicating if the DN is to be parsed for the username. If set to
true , the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.
|
usernameBeginString
|
a string
|
none
|
Defines the string which is to be removed from the start of the DN to reveal the username. This option is used together with
usernameEndString .
|
usernameEndString
|
a string
|
none
|
Defines the string which is to be removed from the end of the DN to reveal the username. This option is used together with
usernameBeginString .
|
roleNameAttributeID
| An attribute | group
|
Name of the attribute within the
roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true , this property is used to find the role object's name attribute.
|
distinguishedNameAttribute
| An attribute | distinguishedName
|
The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters (backslash for example) that prevent correct user mapping. If the attribute does not exist, the entry's DN is used.
|
roleRecursion
| An integer | 0
|
The numbers of levels of recursion the role search will go below a matching context. Disable recursion by setting this to
0 .
|
searchTimeLimit
| An integer | 10000 (10 seconds)
|
The timeout in milliseconds for user or role searches.
|
searchScope
|
One of:
OBJECT_SCOPE, ONELEVEL_SCOPE, SUBTREE_SCOPE
| SUBTREE_SCOPE
|
The search scope to use.
|
allowEmptyPasswords
| true or false
| true
|
Whether to allow empty passwords. Most LDAP servers treat empty passwords as anonymous login attempts. To reject empty passwords, set this to false.
|
Table 11.19. RoleMapping
Code | RoleMapping
|
Class | org.jboss.security.auth.spi.RoleMappingLoginModule
|
Description |
Maps a role which is the end result of the authentication process to a declarative role. This module must be flagged as
optional when you add it to the security domain.
|
Table 11.20. RoleMapping
Module Options
Option | Type | Default | Description |
---|---|---|---|
rolesProperties
| The fully-qualified file path and name of a properties file or resource | roles.properties
|
The fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is
original_role=role1,role2,role3
|
replaceRole
| true or false
| false
|
Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to
true .
|
Table 11.21. RunAs
Code | RunAs
|
Class | Class: org.jboss.security.auth.spi.RunAsLoginModule
|
Description |
A helper module that pushes a
run as role onto the stack for the duration of the login phase of authentication, and pops the run as role off the stack in either the commit or abort phase. This login module provides a role for other login modules that must access secured resources in order to perform their authentication, such as a login module which accesses a secured EJB. RunAsLoginModule must be configured before the login modules that require a run as role to be established.
|
Table 11.22. RunAs
Options
Option | Type | Default | Description |
---|---|---|---|
roleName
| A role name. | nobody
|
The name of the role to use as the
run as role during the login phase.
|
Table 11.23. Simple
Code | Simple
|
Class | org.jboss.security.auth.spi.SimpleServerLoginModule
|
Description |
A module for quick setup of security for testing purposes. It implements the following simple algorithm:
|
Simple
Module Options
The Simple
module has no options.
Table 11.24. ConfiguredIdentity
Code | ConfiguredIdentity
|
Class | org.picketbox.datasource.security.ConfiguredIdentityLoginModule
|
Description |
Associates the principal specified in the module options with any subject authenticated against the module. The type of Principal class used is
org.jboss.security.SimplePrincipal .
|
Table 11.25. ConfiguredIdentity
Module Options
Option | Type | Default | Description |
---|---|---|---|
principal
| Name of a principal. | none
|
The principal which will be associated with any subject authenticated against the module.
|
Table 11.26. SecureIdentity
Code | SecureIdentity
|
Class | org.picketbox.datasource.security.SecureIdentityLoginModule
|
Description |
This module is provided for legacy purposes. It allows you to encrypt a password and then use the encrypted password with a static principal. If your application uses
SecureIdentity , consider using a password vault mechanism instead.
|
Table 11.27. SecureIdentity
Module Options
Option | Type | Default | Description |
---|---|---|---|
username
| string | none | The username for authentication. |
password
| encrypted string | none |
The password to use for authentication. To encrypt the password, use the module directly at the command line.
Paste the result of this command into the module option's value field.
|
managedConnectionFactoryName
| A JCA resource | none |
The name of the JCA connection factory for your datasource.
|
Table 11.28. PropertiesUsers
Code | PropertiesUsers
|
Class | org.jboss.security.auth.spi.PropertiesUsersLoginModule
|
Description |
Uses a properties file to store usernames and passwords for authentication. No authorization (role mapping) is provided. This module is only appropriate for testing.
|
Table 11.29. PropertiesUsers
Module Options
Option | Type | Default | Description |
---|---|---|---|
properties
| The fully-qualified file path and name of a Java properties file or resource. | none |
The properties file containing the usernames and clear-text passwords to be used for authentication.
|
Table 11.30. SimpleUsers
Code | SimpleUsers
|
Class | org.jboss.security.auth.spi.SimpleUsersLoginModule
|
Description |
This login module stores the username and clear-text password in a Java properties file. It is included for testing only, and is not appropriate for a production environment.
|
Table 11.31. SimpleUsers
Module Options
Option | Type | Default | Description |
---|---|---|---|
username
| string | none | The username to use for authentication. |
password
| string | none | The clear-text password to use for authentication. |
Table 11.32. LdapUsers
Code | LdapUsers
|
Class | org.jboss.security.auth.spi.LdapUsersLoginModule
|
Description |
The
LdapUsers module is superseded by the ExtendedLDAP and AdvancedLdap modules.
|
Table 11.33. Kerberos
Code | Kerberos
|
Class | com.sun.security.auth.module.Krb5LoginModule
|
Description |
Performs Kerberos login authentication, using GSSAPI. This module is part of the security framework from the API provided by Sun Microsystems. Details can be found at http://docs.oracle.com/javase/1.4.2/docs/guide/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html. This module needs to be paired with another module which handles the authentication and roles mapping.
|
Table 11.34. Kerberos
Module Options
Option | Type | Default | Description |
---|---|---|---|
storekey
| true or false
| false |
Whether or not to add the
KerberosKey to the subject's private credentials.
|
doNotPrompt
| true or false
| false |
If set to
true , the user is not prompted for the password.
|
useTicketCache
|
Boolean value of
. true or false
| false |
If
true , the GTG is obtained from the ticket cache. If false , the ticket cache is not used.
|
ticketcache
| A file or resource representing a Kerberos ticket cache. |
The default depends on which operating system you use.
| The location of the ticket cache. |
useKeyTab
| true or false
| false | Whether to obtain the principal's key from a key table file. |
keytab
| A file or resource representing a Kerberos keytab. |
the location in the operating system's Kerberos configuration file, or
/home/user/krb5.keytab
| The location of the key table file. |
principal
| A string | none |
The name of the principal. This can either be a simple user name or a service name such as
host/testserver.acme.com . Use this instead of obtaining the principal from the key table, or when the key table contains more than one principal.
|
useFirstPass
| true or false
| false |
Whether to retrieve the username and password from the module's shared state, using
javax.security.auth.login.name and javax.security.auth.login.password as the keys. If authentication fails, no retry attempt is made.
|
tryFirstPass
| true or false
| false |
Same as
useFirstPass , but if authentication fails, the module uses the CallbackHandler to retrieve a new username and password. If the second authentication fails, the failure is reported to the calling application.
|
storePass
| true or false
| false |
Whether to store the username and password in the module's shared state. This does not happen if the keys already exist in the shared state, or if authentication fails.
|
clearPass
| true or false
| false |
Set this to
true to clear the username and password from the shared state after both phases of authentication complete.
|
Table 11.35. SPNEGOUsers
Code | SPNEGOUsers
|
Class | org.jboss.security.negotiation.spnego.SPNEGOLoginModule
|
Description |
Allows SPNEGO authentication to a Microsoft Active Directory server or other environment which supports SPNEGO. SPNEGO can also carry Kerberos credentials. This module needs to be paired with another module which handles authentication and role mapping.
|
Table 11.36. SPNEGO
Module Options
Option | Type | Default | Description |
---|---|---|---|
storeKey
| true or false
| false
|
Whether or not to store the key.
|
useKeyTab
| true or false
| false
|
Whether to use a key table.
|
principal
|
String reperesenting a principal for Kerberos auhentication.
|
none
|
The name of the principal for authentication.
|
keyTab
|
A file or resource representing a keytab.
| none
|
The location of a key table.
|
doNotPrompt
| true or false
| false
|
Whether to prompt for a password.
|
debug
| true or false
| false
|
Whether to record more verbose messages for debugging purposes.
|
Table 11.37. AdvancedLdap
Code | AdvancedLdap |
Class | org.jboss.security.negotiation.AdvancedLdapLoginModule
|
Description |
A module which provides additional functionality, such as SASL and the use of a JAAS security domain.
|
Table 11.38. AdvancedLdap
Module Options
Option | Type | Default | Description |
---|---|---|---|
bindAuthentication
|
string
|
none
|
The type of SASL authentication to use for binding to the directory server.
|
java.naming.provider.url
| string
|
none
|
The URI of the directory server.
|
baseCtxDN
|
A fully qualified Distinguished Name (DN).
|
none
|
The distinguished name to use as the base for searches.
|
baseFilter
|
String representing a LDAP search filter.
|
none
|
The filter to use to narrow down search results.
|
roleAttributeID
|
A string representing an LDAP attribute.
|
none
|
The LDAP attribute which contains the names of authorization roles.
|
roleAttributeIsDN
| true or false
| false
|
Whether the role attribute is a Distinguished Name (DN).
|
roleNameAttributeID
|
String representing an LDAP attribute.
|
none
|
The attribute contained within the
RoleAttributeId which contains the actual role attribute.
|
recurseRoles
| true or false
| false
|
Whether to recorsively search the
RoleAttributeId for roles.
|
Table 11.39. AdvancedADLdap
Code | AdvancedADLdap |
Class | org.jboss.security.negotiation.AdvancedADLoginModule
|
Description |
This module extends the
AdvancedLdap login module, and adds extra parameters that are relevant to Microsoft Active Directory.
|
Table 11.40. UsersRoles
Code | UsersRoles |
Class | org.jboss.security.auth.spi.UsersRolesLoginModul
|
Description |
A simple login module that supports multiple users and user roles stored in two different properties files.
|
Table 11.41. UsersRoles
Module Options
Option | Type | Default | Description |
---|---|---|---|
usersProperties
|
Path to a file or resource.
| users.properties
|
The file or resource which contains the user-to-password mappings. The format of the file is
user=hashed-password
|
rolesProperties
|
Path to a file or resource.
| roles.properties
|
The file or resource which contains the user-to-role mappings. The format of the file is
username=role1,role2,role3
|
password-stacking
| useFirstPass or false
| false
|
A value of
useFirstPass indicates that this login module should first look to the information stored in the LoginContext for the identity. This option can be used when stacking other login modules with this one.
|
hashAlgorithm
|
A string representing a password hashing algorithm.
| none
|
The name of the
java.security.MessageDigest algorithm to use to hash the password. There is no default so this option must be explicitly set to enable hashing. When hashAlgorithm is specified, the clear text password obtained from the CallbackHandler is hashed before it is passed to UsernamePasswordLoginModule.validatePassword as the inputPassword argument. The password stored in the users.properties file must be comparably hashed.
|
hashEncoding
| base64 or hex
| base64
|
The string format for the hashed password, if hashAlgorithm is also set.
|
hashCharset
|
A string
|
The default encoding set in the container's runtime environment
|
The encoding used to convert the clear-text password to a byte array.
|
unauthenticatedIdentity
|
A principal name
|
none
|
Defines the principal name assigned to requests which contain no authentication information. This can allow unprotected servlets to invoke methods on EJBs that do not require a specific role. Such a principal has no associated roles and can only access unsecured EJBs or EJB methods that are associated with the
unchecked permission constraint.
|
Authentication modules are implementations of javax.security.auth.spi.LoginModule
. Refer to the API documentation for more information about creating a custom authentication module.
11.2. Included Authorization Modules
Code | Class |
---|---|
DenyAll | org.jboss.security.authorization.modules.AllDenyAuthorizationModule |
PermitAll | org.jboss.security.authorization.modules.AllPermitAuthorizationModule |
Delegating | org.jboss.security.authorization.modules.DelegatingAuthorizationModule |
Web | org.jboss.security.authorization.modules.WebAuthorizationModule |
JACC | org.jboss.security.authorization.modules.JACCAuthorizationModule |
11.3. Included Security Mapping Modules
Code | Class |
---|---|
PropertiesRoles | org.jboss.security.mapping.providers.role.PropertiesRolesMappingProvider |
SimpleRoles | org.jboss.security.mapping.providers.role.SimpleRolesMappingProvider |
DeploymentRoles | org.jboss.security.mapping.providers.DeploymentRolesMappingProvider |
DatabaseRoles | org.jboss.security.mapping.providers.role.DatabaseRolesMappingProvider |
LdapRoles | org.jboss.security.mapping.providers.role.LdapRolesMappingProvider |
11.4. Included Security Auditing Provider Modules
Code | Class |
---|---|
LogAuditProvider | org.jboss.security.audit.providers.LogAuditProvider |
Chapter 12. Subsystem Configuration
12.1. Subsystem Configuration Overview
JBoss EAP 6 uses a simplified configuration, with one configuration file per domain or per standalone server. In a standalone domain, a separate file exists for each host controller as well. Changes to the configuration persist automatically, so XML should not be edited by hand. The configuration is scanned and overwritten automatically by the Management API. The command-line based Management CLI and web-based Management Console allow you to configure each aspect of JBoss EAP 6.
EAP_HOME/domain/configuration/domain.xml
for a managed domain or EAP_HOME/standalone/configuration/standalone.xml
for a standalone server. Many of the subsystems include configuration details that were configured via deployment descriptors in previous versions of JBoss EAP.
Each subsystem's configuration is defined in an XML schema. The configuration schema are located in the EAP_HOME/docs/schema/
directory of your installation.
Simple Subsystems
ee
– the Java EE 6 API implementationejb
– the Enterprise JavaBeans (EJB) subsystemjaxrs
– the JAX-RS API, provided by RESTeasy.sar
– the subsystem which supports Service Archives.threads
– the subsystem which supports process threads.weld
– the Contexts and Dependency Injection API, provided by Weld.
Chapter 13. The Logging Subsystem
13.1. Introduction
13.1.1. Overview of Logging
13.1.2. Application Logging Frameworks Supported By JBoss LogManager
- JBoss Logging - included with JBoss EAP 6
- Apache Commons Logging - http://commons.apache.org/logging/
- Simple Logging Facade for Java (SLF4J) - http://www.slf4j.org/
- Apache log4j - http://logging.apache.org/log4j/1.2/
- Java SE Logging (java.util.logging) - http://download.oracle.com/javase/6/docs/api/java/util/logging/package-summary.html
13.1.3. Configure Boot Logging
logging.properties
file. This file is a standard Java properties file and can be edited in a text editor. Each line in the file has the format of property=value
.
logging.properties
file is either EAP_HOME/domain/configuration/logging.properties
or EAP_HOME/standalone/configuration/logging.properties
.
13.1.4. Default Log File Locations
Table 13.1. Default Log File for a standalone server
Log File | Description |
---|---|
EAP_HOME/standalone/log/server.log |
The Server Log. Contains all server log messages, including server startup messages.
|
Table 13.2. Default Log Files for a managed domain
Log File | Description |
---|---|
EAP_HOME/domain/log/host-controller.log |
Host Controller boot log. Contains log messages related to the startup of the host controller.
|
EAP_HOME/domain/log/process-controller.log |
Process controller boot log. Contains log messages related to the startup of the process controller.
|
EAP_HOME/domain/servers/SERVERNAME/log/server.log |
The server log for the named server. Contains all log messages for that server, including server startup messages.
|
13.1.5. Filter Expressions for Logging
Table 13.3. Filter Expressions for Logging
Filter Type
expression
| Description | Parameters |
---|---|---|
Accept
accept
| Accept all log messages | accept
|
Deny
deny
| Deny all log messages | deny
|
Not
not[filter expression]
| Returns the inverted value of the filter expression |
Takes single filter expression as a parameter
not(match("JBAS"))
|
All
all[filter expression]
| Returns concatenated value from multiple filter expressions. |
Takes multiple filter expressions delimited by commas
all(match("JBAS"),match("WELD"))
|
Any
any[filter expression]
| Returns one value from multiple filter expressions. |
Takes multiple filter expressions delimited by commas
any(match("JBAS"),match("WELD"))
|
Level Change
levelChange[level]
| Modifies the log record with the specified level |
Takes single string-based level as an argument
levelChange("WARN")
|
Levels
levels[levels]
| Filters log messages with a level listed in the list of levels |
Takes multiple string-based levels delimited by commas as argument
levels("DEBUG","INFO","WARN","ERROR")
|
Level Range
levelRange[minLevel,maxLevel]
| Filters log messages within the specified level range |
The filter expression uses a "[" to indicate a minimum inclusive level and a "]" to indicate a maximum inclusive level. Alternatively, one can use "(" or ")" respectively to indicate exclusive. The first argument for the expression is the minimum level allowed, the second argument is the maximum level allowed.
|
Match (match["pattern"] ) | A regular-expression based filter. The unformatted message is used against the pattern specified in the expression. |
Takes a regular expression as argument
match("JBAS\d+")
|
Substitute (substitute["pattern","replacement value"] ) | A filter which replaces the first match to the pattern with the replacement value |
The first argument for the expression is the pattern the second argument is the replacement text
substitute("JBAS","EAP")
|
Substitute All (substituteAll["pattern","replacement value"] ) | A filter which replaces all matches of the pattern with the replacement value |
The first argument for the expression is the pattern the second argument is the replacement text
substituteAll("JBAS","EAP")
|
13.1.6. About Log Levels
TRACE
, DEBUG
, INFO
, WARN
, ERROR
and FATAL
.
WARN
will only record messages of the levels WARN
, ERROR
and FATAL
.
13.1.7. Supported Log Levels
Table 13.4. Supported Log Levels
Log Level | Value | Description |
---|---|---|
FINEST | 300 |
-
|
FINER | 400 |
-
|
TRACE | 400 |
Use for messages that provide detailed information about the running state of an application. Log messages of
TRACE are usually only captured when debugging an application.
|
DEBUG | 500 |
Use for messages that indicate the progress individual requests or activities of an application. Log messages of
DEBUG are usually only captured when debugging an application.
|
FINE | 500 |
-
|
CONFIG | 700 |
-
|
INFO | 800 |
Use for messages that indicate the overall progress of the application. Often used for application startup, shutdown and other major lifecycle events.
|
WARN | 900 |
Use to indicate a situation that is not in error but is not considered ideal. May indicate circumstances that may lead to errors in the future.
|
WARNING | 900 |
-
|
ERROR | 1000 |
Use to indicate an error that has occurred that could prevent the current activity or request from completing but will not prevent the application from running.
|
SEVERE | 1000 |
-
|
FATAL | 1100 |
Use to indicate events that could cause critical service failure and application shutdown and possibly cause JBoss EAP 6 to shutdown.
|
13.1.8. About Log Categories
13.1.9. About the Root Logger
server.log
. This file is sometimes referred to as the server log.
13.1.10. About Log Handlers
Console
, File
, Periodic
, Size
, Async
and Custom
.
13.1.11. Types of Log Handlers
- Console
- Console log handlers write log messages to either the host operating system's standard out (stdout) or standard error (stderr) stream. These messages are displayed when JBoss EAP 6 is run from a command line prompt. The messages from a Console log handler are not saved unless the operating system is configured to capture the standard out or standard error stream.
- File
- File log handlers are the simplest log handlers that write log messages to a specified file.
- Periodic
- Periodic log handlers write log messages to a named file until a specified period of time has elapsed. Once the time period has passed then the file is renamed by appending the specified timestamp and the handler continues to write into a newly created log file with the original name.
- Size
- Size log handlers write log messages to a named file until the file reaches a specified size. When the file reaches a specified size, it is renamed with a numeric prefix and the handler continues to write into a newly created log file with the original name. Each size log handler must specify the maximum number of files to be kept in this fashion.
- Async
- Async log handlers are wrapper log handlers that provide asynchronous behaviour for one or more other log handlers. These are useful for log handlers that may have high latency or other performance problems such as writing a log file to a network file system.
- Custom
- Custom log handlers enable to you to configure new types of log handlers that have been implemented. A custom handler must be implemented as a Java class that extends
java.util.logging.Handler
and be contained in a module.
13.1.12. About Log Formatters
java.util.Formatter
class.
%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n
, creates log messages that look like:
15:53:26,546 INFO [org.jboss.as] (Controller Boot Thread) JBAS015951: Admin console listening on http://127.0.0.1:9990
13.1.13. Log Formatter Syntax
Table 13.5. Log Formatter Syntax
Symbol | Description |
---|---|
%c | The category of the logging event |
%p | The level of the log entry (info/debug/etc) |
%P | The localized level of the log entry |
%d | The current date/time (yyyy-MM-dd HH:mm:ss,SSS form) |
%r | The relative time (milliseconds since the log was initialised) |
%z | The time zone |
%k | A log resource key (used for localization of log messages) |
%m | The log message (including exception trace) |
%s | The simple log message (no exception trace) |
%e | The exception stack trace (no extended module information) |
%E | The exception stack trace (with extended module information) |
%t | The name of the current thread |
%n | A newline character |
%C | The class of the code calling the log method (slow) |
%F | The filename of the class calling the log method (slow) |
%l | The source location of the code calling the log method (slow) |
%L | The line number of the code calling the log method (slow) |
%M | The method of the code calling the log method (slow) |
%x | The Log4J Nested Diagnostic Context |
%X | The Log4J Message Diagnostic Context |
%% | A literal percent character (escaping) |
13.2. Configure Logging in the Management Console
- Login to the Management Console
- Navigate to the logging subsystem configuration. This step varies between servers running as standalone servers and servers running in a managed domain.
Standalone Server
Click on Profile, expand Core in the Profile pane, and then click on Logging.Managed Domain
Click on Profile, select the profile to edit, expand Core, and then click on Logging.
Figure 13.1. Logging Configuration in the Management Console
- Edit the log level.
- Add and remove log handlers.
- Add and remove log categories.
- Edit log category properties.
- Add and remove log handlers from a category.
- Adding new handlers.
- Configuring handlers.
13.3. Logging Configuration in the CLI
13.3.1. Configure the Root Logger with the CLI
- Add log handlers to the root logger.
- Display the root logger configuration.
- Change the log level.
- Remove log handlers from the root logger.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a Log Handler to the Root Logger
- Use the
root-logger-assign-handler
operation with the following syntax where HANDLER is the name of the log handler to be added./subsystem=logging/root-logger=ROOT:root-logger-assign-handler(name="HANDLER")
The log handler must already have been created before it can be added to the root logger.Example 13.1. Root Logger root-logger-assign-handler operation
[standalone@localhost:9999 /] /subsystem=logging/root-logger=ROOT:root-logger-assign-handler(name="AccountsNFSAsync") {"outcome" => "success"} [standalone@localhost:9999 /]
- Display the Contents of the Root Logger Configuration
- Use the
read-resource
operation with the following syntax./subsystem=logging/root-logger=ROOT:read-resource
Example 13.2. Root Logger read-resource operation
[standalone@localhost:9999 /] /subsystem=logging/root-logger=ROOT:read-resource { "outcome" => "success", "result" => { "filter" => {"match" => "names"}, "handlers" => [ "CONSOLE", "FILE" ], "level" => "INFO" } }
- Set the Log Level of the Root Logger
- Use the
write-attribute
operation with the following syntax where LEVEL is one of the supported log levels./subsystem=logging/root-logger=ROOT:write-attribute(name="level", value="LEVEL")
Example 13.3. Root Logger write-attribute operation to set the log level
[standalone@localhost:9999 /] /subsystem=logging/root-logger=ROOT:write-attribute(name="level", value="DEBUG") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a Log Handler from the Root Logger
- Use the
root-logger-unassign-handler
with the following syntax, where HANDLER is the name of the log handler to be removed./subsystem=logging/root-logger=ROOT:root-logger-unassign-handler(name="HANDLER")
Example 13.4. Remove a Log Handler
[standalone@localhost:9999 /] /subsystem=logging/root-logger=ROOT:root-logger-unassign-handler(name="AccountsNFSAsync") {"outcome" => "success"} [standalone@localhost:9999 /]
13.3.2. Configure a Log Category in the CLI
- Add a new log category.
- Display the configuration of a log category.
- Set the log level.
- Add log handlers to a log category.
- Remove log handlers from a log category.
- Remove a log category.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a log category
- Use the
add
operation with the following syntax. Replace CATEGORY with the category to be added./subsystem=logging/logger=CATEGORY:add
Example 13.5. Adding a new log category
[standalone@localhost:9999 /] /subsystem=logging/logger=com.company.accounts.rec:add {"outcome" => "success"} [standalone@localhost:9999 /]
- Display a log category configuration
- Use the
read-resource
operation with the following syntax. Replace CATEGORY with the name of the category./subsystem=logging/logger=CATEGORY:read-resource
Example 13.6. Log Category read-resource operation
[standalone@localhost:9999 /] /subsystem=logging/logger=org.apache.tomcat.util.modeler:read-resource { "outcome" => "success", "result" => { "filter" => undefined, "handlers" => undefined, "level" => "WARN", "use-parent-handlers" => true } } [standalone@localhost:9999 /]
- Set the log level
- Use the
write-attribute
operation with the following syntax. Replace CATEGORY with the name of the log category and LEVEL with the log level that is to be set./subsystem=logging/logger=CATEGORY:write-attribute(name="level", value="LEVEL")
Example 13.7. Setting a log level
[standalone@localhost:9999 /] /subsystem=logging/logger=com.company.accounts.rec:write-attribute(name="level", value="DEBUG") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the log category to use the log handlers of the root logger.
- Use the
write-attribute
operation with the following syntax. Replace CATEGORY with the name of the log category. Replace BOOLEAN with true for this log category to use the handlers of the root logger. Replace it with false if it is to use only its own assigned handlers./subsystem=logging/logger=CATEGORY:write-attribute(name="use-parent-handlers", value="BOOLEAN")
Example 13.8. Setting use-parent-handlers
[standalone@localhost:9999 /] /subsystem=logging/logger=com.company.accounts.rec:write-attribute(name="use-parent-handlers", value="true") {"outcome" => "success"} [standalone@localhost:9999 /]
- Add a log handlers to a log category
- Use the
assign-handler
operation with the following syntax. Replace CATEGORY with the name of the category and HANDLER with the name of the handler to be added./subsystem=logging/logger=CATEGORY:assign-handler(name="HANDLER")
The log handler must already have been created before it can be added to the root logger.Example 13.9. Adding a log handler
[standalone@localhost:9999 /] /subsystem=logging/logger=com.company.accounts.rec:assign-handler(name="AccountsNFSAsync") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a log handler from a log category
- Use the
unassign-handler
operation with the following syntax. Replace CATEGORY with the name of the category and HANDLER with the name of the log handler to be removed./subsystem=logging/logger=CATEGORY:unassign-handler(name="HANDLER")
Example 13.10. Removing a log handler
[standalone@localhost:9999 /] /subsystem=logging/root-logger=ROOT:root-logger-unassign-handler(name="AccountsNFSAsync") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a category
- Use the
remove
operation with the following syntax. Replace CATEGORY with the name of the category to be removed./subsystem=logging/logger=CATEGORY:remove
Example 13.11. Removing a log category
[standalone@localhost:9999 /] /subsystem=logging/logger=com.company.accounts.rec:remove {"outcome" => "success"} [standalone@localhost:9999 /]
13.3.3. Configure a Console Log Handler in the CLI
- Add a new console log handler.
- Display the configuration of a console log handler.
- Set the handler's log level.
- Set the target for the handler's output.
- Set the encoding used for the handler's output.
- Set the formatter used for the handler's output.
- Set whether the handler uses autoflush or not.
- Remove a console log handler.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a Console Log Handler
- Use the
add
operation with the following syntax. Replace HANDLER with the console log handler to be added./subsystem=logging/console-handler=HANDLER:add
Example 13.12. Add a Console Log Handler
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:add {"outcome" => "success"} [standalone@localhost:9999 /]
- Display a console log handler configuration
- Use the
read-resource
operation with the following syntax. Replace HANDLER with the name of the console log handler./subsystem=logging/console-handler=HANDLER:read-resource
Example 13.13. Display a console log handler configuration
[standalone@localhost:9999 /] /subsystem=logging/console-handler=CONSOLE:read-resource { "outcome" => "success", "result" => { "autoflush" => true, "encoding" => undefined, "filter" => undefined, "formatter" => "%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n", "level" => "INFO", "target" => "System.out" } } [standalone@localhost:9999 /]
- Set the Log Level
- Use the
change-log-level
operation with the following syntax. Replace HANDLER with the name of the console log handler and LEVEL with the log level that is to be set./subsystem=logging/console-handler=HANDLER:change-log-level(level="LEVEL")
Example 13.14. Set the Log Level
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:change-log-level(level="TRACE") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Target
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the console log handler. Replace TARGET with eitherSystem.err
orSystem.out
for the system error stream or standard out stream respectively./subsystem=logging/console-handler=HANDLER:write-attribute(name="target", value="TARGET")
Example 13.15. Set the Target
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:write-attribute(name="target", value="System.err") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Encoding
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the console log handler. Replace ENCODING with the name of the required character encoding system./subsystem=logging/console-handler=HANDLER:write-attribute(name="encoding", value="ENCODING")
Example 13.16. Set the Encoding
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:write-attribute(name="encoding", value="utf-8") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Formatter
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the console log handler. Replace FORMAT with the required formatter string./subsystem=logging/console-handler=HANDLER:write-attribute(name="formatter", value="FORMAT")
Example 13.17. Set the Formatter
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:write-attribute(name="formatter", value="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Auto Flush
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the console log handler. Replace BOOLEAN withtrue
if this handler is to immediately write its output./subsystem=logging/console-handler=HANDLER:write-attribute(name="autoflush", value="BOOLEAN")
Example 13.18. Set the Auto Flush
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:write-attribute(name="autoflush", value="true") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a Console Log Handler
- Use the
remove
operation with the following syntax. Replace HANDLER with the name of the console log handler to be removed./subsystem=logging/console-handler=HANDLER:remove
Example 13.19. Remove a Console Log Handler
[standalone@localhost:9999 /] /subsystem=logging/console-handler=ERRORCONSOLE:remove {"outcome" => "success"} [standalone@localhost:9999 /]
13.3.4. Configure a File Log Handler in the CLI
- Add a new file log handler.
- Display the configuration of a file log handler
- Set the handler's log level.
- Set the handler's appending behavior.
- Set whether the handler uses autoflush or not.
- Set the encoding used for the handler's output.
- Specify the file to which the log handler will write.
- Set the formatter used for the handler's output.
- Remove a file log handler.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a file log handler
- Use the
add
operation with the following syntax. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable./subsystem=logging/file-handler=HANDLER:add(file={"path"=>"PATH", "relative-to"=>"DIR"})
Example 13.20. Add a file log handler
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:add(file={"path"=>"accounts.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /]
- Display a file log handler configuration
- Use the
read-resource
operation with the following syntax. Replace HANDLER with the name of the file log handler./subsystem=logging/file-handler=HANDLER:read-resource
Example 13.21. Using the read-resource operation
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:read-resource { "outcome" => "success", "result" => { "append" => true, "autoflush" => true, "encoding" => undefined, "file" => { "path" => "accounts.log", "relative-to" => "jboss.server.log.dir" }, "filter" => undefined, "formatter" => "%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n", "level" => undefined } } [standalone@localhost:9999 /]
- Set the Log level
- Use the
change-log-level
operation with the following syntax. Replace HANDLER with the name of the file log handler. Replace LEVEL with the log level that is to be set./subsystem=logging/file-handler=HANDLER:change-log-level(level="LEVEL")
Example 13.22. Changing the log level
/subsystem=logging/file-handler=accounts_log:change-log-level(level="DEBUG") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the append behaviour
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the file log handler. Replace BOOLEAN with false if you required that a new log file be created each time the application server is launched. Replace BOOLEAN withtrue
if the application server should continue to use the same file./subsystem=logging/file-handler=HANDLER:write-attribute(name="append", value="BOOLEAN")
Example 13.23. Changing the append property
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:write-attribute(name="append", value="true") { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9999 /]
JBoss EAP 6 must be restarted for this change to take effect. - Set the Auto Flush
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the file log handler. Replace BOOLEAN withtrue
if this handler is to immediately write its output./subsystem=logging/file-handler=HANDLER:write-attribute(name="autoflush", value="BOOLEAN")
Example 13.24. Changing the autoflush property
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:write-attribute(name="autoflush", value="false") { "outcome" => "success", "response-headers" => {"process-state" => "reload-required"} } [standalone@localhost:9999 /]
JBoss EAP 6 must be restarted for this change to take effect. - Set the Encoding
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the file log handler. Replace ENCODING with the name of the required character encoding system./subsystem=logging/file-handler=HANDLER:write-attribute(name="encoding", value="ENCODING")
Example 13.25. Set the Encoding
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:write-attribute(name="encoding", value="utf-8") {"outcome" => "success"} [standalone@localhost:9999 /]
- Change the file to which the log handler writes
- Use the
change-file
operation with the following syntax. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable./subsystem=logging/file-handler=HANDLER:change-file(file={"path"=>"PATH", "relative-to"=>"DIR"})
Example 13.26. Change the file to which the log handler writes
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:change-file(file={"path"=>"accounts-debug.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Formatter
- Use the
write-attribute
operation with the following syntax. Replace HANDLER with the name of the file log handler. Replace FORMAT with the required formatter string./subsystem=logging/file-handler=HANDLER:write-attribute(name="formatter", value="FORMAT")
Example 13.27. Set the Formatter
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts-log:write-attribute(name="formatter", value="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a File Log Handler
- Use the
remove
operation with the following syntax. Replace HANDLER with the name of the file log handler to be removed./subsystem=logging/file-handler=HANDLER:remove
Example 13.28. Remove a File Log Handler
[standalone@localhost:9999 /] /subsystem=logging/file-handler=accounts_log:remove {"outcome" => "success"} [standalone@localhost:9999 /]
A log handler can only be removed if it is not being referenced by a log category or an async log handler.
13.3.5. Configure a Periodic Log Handler in the CLI
- Add a new periodic log handler.
- Display the configuration of a periodic log handler
- Set the handler's log level.
- Set the handler's appending behaviour.
- Set whether the handler uses autoflush or not.
- Set the encoding used for the handler's output.
- Specify the file to which the log handler will write.
- Set the formatter used for the handler's output.
- Set the suffix for rotated logs
- Remove a periodic log handler.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a new Periodic Rotating File log handler
- Use the
add
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:add(file={"path"=>"PATH", "relative-to"=>"DIR"}, suffix="SUFFIX")
Replace HANDLER with the name of the log handler. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable. Replace SUFFIX with the file rotation suffix to be used.Example 13.29. Add a new handler
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:add(file={"path"=>"daily-debug.log", "relative-to"=>"jboss.server.log.dir"}, suffix=".yyyy.MM.dd") {"outcome" => "success"} [standalone@localhost:9999 /]
- Display a Periodic Rotating File log handler configuration
- Use the
read-resource
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:read-resource
Replace HANDLER with the name of the log handler.Example 13.30. Using the read-resource operation
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:read-resource { "outcome" => "success", "result" => { "append" => true, "autoflush" => true, "encoding" => undefined, "file" => { "path" => "daily-debug.log", "relative-to" => "jboss.server.log.dir" }, "filter" => undefined, "formatter" => "%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n", "level" => undefined } } [standalone@localhost:9999 /]
- Set the Log level
- Use the
change-log-level
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:change-log-level(level="LEVEL")
Replace HANDLER with the name of the periodic log handler. Replace LEVEL with the log level that is to be set.Example 13.31. Set the log level
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:change-log-level(level="DEBUG") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the append behaviour
- Use the
write-attribute
operation with the following syntax./subsystem=logging/periodic-rotating-handler=HANDLER:write-attribute(name="append", value="BOOLEAN")
Replace HANDLER with the name of the periodic log handler. Replace BOOLEAN withfalse
if you required that a new log file be created each time the application server is launched. Replace BOOLEAN withtrue
if the application server should continue to use the same file.JBoss EAP 6 must be restarted for this change to take effect.Example 13.32. Set the append behaviour
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:write-attribute(name="append", value="true") { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9999 /]
- Set the Auto Flush
- Use the
write-attribute
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:write-attribute(name="autoflush", value="BOOLEAN")
Replace HANDLER with the name of the periodic log handler. Replace BOOLEAN withtrue
if this handler is to immediately write its output.JBoss EAP 6 must be restarted for this change to take effect.Example 13.33. Set the Auto Flush behaviour
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:write-attribute(name="autoflush", value="false") { "outcome" => "success", "response-headers" => {"process-state" => "reload-required"} } [standalone@localhost:9999 /]
- Set the Encoding
- Use the
write-attribute
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:write-attribute(name="encoding", value="ENCODING")
Replace HANDLER with the name of the periodic log handler. Replace ENCODING with the name of the required character encoding system.Example 13.34. Set the Encoding
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:write-attribute(name="encoding", value="utf-8") {"outcome" => "success"} [standalone@localhost:9999 /]
- Change the file to which the log handler writes
- Use the
change-file
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:change-file(file={"path"=>"PATH", "relative-to"=>"DIR"})
Replace HANDLER with the name of the periodic log handler. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable.Example 13.35. Change the file to which the log handler writes
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:change-file(file={"path"=>"daily-debug.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the Formatter
- Use the
write-attribute
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:write-attribute(name="formatter", value="FORMAT")
Replace HANDLER with the name of the periodic log handler. Replace FORMAT with the required formatter string.Example 13.36. Set the Formatter
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:write-attribute(name="formatter", value="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the suffix for rotated logs
- Use the
write-attribute
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:write-attribute(name="suffix", value="SUFFIX")
Replace HANDLER with the name of the log handler. Replace SUFFIX with the required suffix string.Example 13.37.
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:write-attribute(name="suffix", value=".yyyy-MM-dd-HH") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a periodic log handler
- Use the
remove
operation with the following syntax./subsystem=logging/periodic-rotating-file-handler=HANDLER:remove
Replace HANDLER with the name of the periodic log handler.Example 13.38. Remove a periodic log handler
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=HOURLY_DEBUG:remove {"outcome" => "success"} [standalone@localhost:9999 /]
13.3.6. Configure a Size Log Handler in the CLI
- Add a new log handler.
- Display the configuration of the log handler
- Set the handler's log level.
- Set the handler's appending behavior.
- Set whether the handler uses autoflush or not.
- Set the encoding used for the handler's output.
- Specify the file to which the log handler will write.
- Set the formatter used for the handler's output.
- Set the maximum size of each log file
- Set the maximum number of backup logs to keep
- Remove a log handler.
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a new log handler
- Use the
add
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:add(file={"path"=>"PATH", "relative-to"=>"DIR"})
Replace HANDLER with the name of the log handler. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable.Example 13.39. Add a new log handler
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:add(file={"path"=>"accounts_trace.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /]
- Display the configuration of the log handler
- Use the
read-resource
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:read-resource
Replace HANDLER with the name of the log handler.Example 13.40. Display the configuration of the log handler
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:read-resource { "outcome" => "success", "result" => { "append" => true, "autoflush" => true, "encoding" => undefined, "file" => { "path" => "accounts_trace.log", "relative-to" => "jboss.server.log.dir" }, "filter" => undefined, "formatter" => "%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n", "level" => undefined, "max-backup-index" => 1, "rotate-size" => "2m" } } [standalone@localhost:9999 /]
- Set the handler's log level
- Use the
change-log-level
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:change-log-level(level="LEVEL")
Replace HANDLER with the name of the log handler. Replace LEVEL with the log level that is to be set.Example 13.41. Set the handler's log level
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:change-log-level(level="TRACE") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the handler's appending behavior
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="append", value="BOOLEAN")
Replace HANDLER with the name of the log handler. Replace BOOLEAN withfalse
if you required that a new log file be created each time the application server is launched. Replace BOOLEAN withtrue
if the application server should continue to use the same file.JBoss EAP 6 must be restarted for this change to take effect.Example 13.42. Set the handler's appending behavior
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="append", value="true") { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9999 /]
- Set whether the handler uses autoflush or not
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="autoflush", value="BOOLEAN")
Replace HANDLER with the name of the log handler. Replace BOOLEAN withtrue
if this handler is to immediately write its output.Example 13.43. Set whether the handler uses autoflush or not
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="autoflush", value="true") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the encoding used for the handler's output
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="encoding", value="ENCODING")
Replace HANDLER with the name of the log handler. Replace ENCODING with the name of the required character encoding system.Example 13.44. Set the encoding used for the handler's output
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="encoding", value="utf-8") {"outcome" => "success"} [standalone@localhost:9999 /]
- Specify the file to which the log handler will write
- Use the
change-file
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:change-file(file={"path"=>"PATH", "relative-to"=>"DIR"})
Replace HANDLER with the name of the log handler. Replace PATH with the filename for the file that the log is being written to. Replace DIR with the name of the directory where the file is to be located. The value of DIR can be a path variable.Example 13.45. Specify the file to which the log handler will write
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:change-file(file={"path"=>"accounts_trace.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the formatter used for the handler's output
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="formatter", value="FORMATTER")
Replace HANDLER with the name of the log handler. Replace FORMAT with the required formatter string.Example 13.46. Set the formatter used for the handler's output
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="formatter", value="%d{HH:mm:ss,SSS} %-5p (%c) [%t] %s%E%n") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the maximum size of each log file
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="rotate-size", value="SIZE")
Replace HANDLER with the name of the log handler. Replace SIZE with maximum file size.Example 13.47. Set the maximum size of each log file
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="rotate-size", value="50m") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the maximum number of backup logs to keep
- Use the
write-attribute
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:write-attribute(name="max-backup-index", value="NUMBER")
Replace HANDLER with the name of the log handler. Replace NUMBER with the required number of log files to keep.Example 13.48. Set the maximum number of backup logs to keep
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:write-attribute(name="max-backup-index", value="5") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove a log handler
- Use the
remove
operation with the following syntax./subsystem=logging/size-rotating-file-handler=HANDLER:remove
Replace HANDLER with the name of the log handler.Example 13.49. Remove a log handler
[standalone@localhost:9999 /] /subsystem=logging/size-rotating-file-handler=ACCOUNTS_TRACE:remove {"outcome" => "success"} [standalone@localhost:9999 /]
13.3.7. Configure a Async Log Handler in the CLI
- Add a new async log handler
- Display the configuration of an async log handler
- Change the log level
- Set the queue length
- Set the overflow action
- Add sub-handlers
- Remove sub-handlers
- Remove an async log handler
Important
/subsystem=logging/logging-profile=NAME/
instead of /subsystem=logging/
.
- Add a new async log handler
- Use the
add
operation with the following syntax./subsystem=logging/async-handler=HANDLER:add(queue-length="LENGTH")
Replace HANDLER with the name of the log handler. Replace LENGTH with value of the maximum number of log requests that can be held in queue.Example 13.50.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:add(queue-length="10") {"outcome" => "success"} [standalone@localhost:9999 /]
- Display the configuration of an async log handler
- Use the
read-resource
operation with the following syntax./subsystem=logging/async-handler=HANDLER:read-resource
Replace HANDLER with the name of the log handler.Example 13.51.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:read-resource { "outcome" => "success", "result" => { "encoding" => undefined, "filter" => undefined, "formatter" => "%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n", "level" => undefined, "overflow-action" => "BLOCK", "queue-length" => "50", "subhandlers" => undefined } } [standalone@localhost:9999 /]
- Change the log level
- Use the
change-log-level
operation with the following syntax./subsystem=logging/async-handler=HANDLER:change-log-level(level="LEVEL")
Replace HANDLER with the name of the log handler. Replace LEVEL with the log level that is to be set.Example 13.52.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:change-log-level(level="INFO") {"outcome" => "success"} [standalone@localhost:9999 /]
- Set the queue length
- Use the
write-attribute
operation with the following syntax./subsystem=logging/async-handler=HANDLER:write-attribute(name="queue-length", value="LENGTH")
Replace HANDLER with the name of the log handler. Replace LENGTH with value of the maximum number of log requests that can be held in queue.JBoss EAP 6 must be restarted for this change to take effect.Example 13.53.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:write-attribute(name="queue-length", value="150") { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9999 /]
- Set the overflow action
- Use the
write-attribute
operation with the following syntax./subsystem=logging/async-handler=HANDLER:write-attribute(name="overflow-action", value="ACTION")
Replace HANDLER with the name of the log handler. Replace ACTION with either DISCARD or BLOCK.Example 13.54.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:write-attribute(name="overflow-action", value="DISCARD") {"outcome" => "success"} [standalone@localhost:9999 /]
- Add sub-handlers
- Use the
assign-subhandler
operation with the following syntax./subsystem=logging/async-handler=HANDLER:assign-subhandler(name="SUBHANDLER")
Replace HANDLER with the name of the log handler. Replace SUBHANDLER with the name of the log handler that is to be added as a sub-handler of this async handler.Example 13.55.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:assign-subhandler(name="NFS_FILE") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove sub-handlers
- Use the
unassign-subhandler
operation with the following syntax./subsystem=logging/async-handler=HANDLER:unassign-subhandler(name="SUBHANDLER")
Replace HANDLER with the name of the log handler. Replace SUBHANDLER with the name of the sub-handler to remove.Example 13.56.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:unassign-subhandler(name="NFS_FILE") {"outcome" => "success"} [standalone@localhost:9999 /]
- Remove an async log handler
- Use the
remove
operation with the following syntax./subsystem=logging/async-handler=HANDLER:remove
Replace HANDLER with the name of the log handler.Example 13.57.
[standalone@localhost:9999 /] /subsystem=logging/async-handler=NFS_LOGS:remove {"outcome" => "success"} [standalone@localhost:9999 /]
13.4. Logging Profiles
13.4.1. About Logging Profiles
Important
- A unique name. This is required.
- Any number of log handlers.
- Any number of log categories.
- Up to one root logger.
Important
13.4.2. Create a new Logging Profile using the CLI
/subsystem=logging/logging-profile=NAME:add
13.4.3. Configuring a Logging Profile using the CLI
- The root configuration path is
/subsystem=logging/logging-profile=NAME
- A logging profile cannot contain other logging profiles.
Example 13.58. Creating and Configuring a Logging Profile
- Create the profile:
/subsystem=logging/logging-profile=accounts-app-profile:add
- Create file handler
/subsystem=logging/logging-profile=accounts-app-profile/file-handler=ejb-trace-file:add(file={path=>"ejb-trace.log", "relative-to"=>"jboss.server.log.dir"})
/subsystem=logging/logging-profile=accounts-app-profile/file-handler=ejb-trace-file:change-log-level(level="DEBUG")
- Create logger category
/subsystem=logging/logging-profile=accounts-app-profile/logger=com.company.accounts.ejbs:add(level=TRACE)
- Assign file handler to category
/subsystem=logging/logging-profile=accounts-app-profile/logger=com.company.accounts.ejbs:assign-handler(name="ejb-trace-file")
13.4.4. Specify a Logging Profile in an Application
MANIFEST.MF
file.
Prerequisites:
- You must know the name of the logging profile that has been setup on the server for this application to use. Ask your server administrator for the name of the profile to use.
Procedure 13.1. Add Logging Profile configuration to an Application
Edit
MANIFEST.MF
If your application does not have aMANIFEST.MF
file: create one with the following content, replacing NAME with the required profile name.Manifest-Version: 1.0 Logging-Profile: NAME
If your application already has aMANIFEST.MF
file: add the following line to it, replacing NAME with the required profile name.Logging-Profile: NAME
Note
maven-war-plugin
, you can put your MANIFEST.MF file in src/main/resources/META-INF/
and add the following configuration to your pom.xml
file.
<plugin> <artifactId>maven-war-plugin</artifactId> <configuration> <archive> <manifestFile>src/main/resources/META-INF/MANIFEST.MF</manifestFile> </archive> </configuration> </plugin>
13.4.5. Example Logging Profile Configuration
MANIFEST.MF
file of the application.
- The Name is
accounts-app-profile
. - The Log Category is
com.company.accounts.ejbs
. - The Log level
TRACE
. - The Log handler is a file handler using the file
ejb-trace.log
.
Example 13.59. CLI session
localhost:bin user$ ./jboss-cli.sh -c [standalone@localhost:9999 /] /subsystem=logging/logging-profile=accounts-app-profile:add {"outcome" => "success"} [standalone@localhost:9999 /] /subsystem=logging/logging-profile=accounts-app-profile/file-handler=ejb-trace-file:add(file={path=>"ejb-trace.log", "relative-to"=>"jboss.server.log.dir"}) {"outcome" => "success"} [standalone@localhost:9999 /] /subsystem=logging/logging-profile=accounts-app-profile/file-handler=ejb-trace-file:change-log-level(level="DEBUG") {"outcome" => "success"} [standalone@localhost:9999 /] /subsystem=logging/logging-profile=accounts-app-profile/logger=com.company.accounts.ejbs:add(level=TRACE) {"outcome" => "success"} [standalone@localhost:9999 /] /subsystem=logging/logging-profile=accounts-app-profile/logger=com.company.accounts.ejbs:assign-handler(name="ejb-trace-file") {"outcome" => "success"} [standalone@localhost:9999 /]
Example 13.60. XML Configuration
<logging-profiles> <logging-profile name="accounts-app-profile"> <file-handler name="ejb-trace-file"> <level name="DEBUG"/> <file relative-to="jboss.server.log.dir" path="ejb-trace.log"/> </file-handler> <logger category="com.company.accounts.ejbs"> <level name="TRACE"/> <handlers> <handler name="ejb-trace-file"/> </handlers> </logger> </logging-profile> </logging-profiles>
Example 13.61. Application MANIFEST.MF file
Manifest-Version: 1.0 Logging-Profile: accounts-app-profile
13.5. Logging Configuration Properties
13.5.1. Root Logger Properties
Table 13.6. Root Logger Properties
Property | Datatype | Description |
---|---|---|
level | String |
The maximum level of log message that the root logger records.
|
handlers | String[] |
A list of log handlers that are used by the root logger.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.2. Log Category Properties
Table 13.7. Log Category Properties
Property | Datatype | Description |
---|---|---|
level | String |
The maximum level of log message that the log category records.
|
handlers | String[] |
A list of log handlers that are used by the root logger.
|
use-parent-handlers | Boolean |
If set to true, this category will use the log handlers of the root logger in addition to any other assigned handlers.
|
category | String |
The log category from which log messages will be captured.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.3. Console Log Handler Properties
Table 13.8. Console Log Handler Properties
Property | Datatype | Description |
---|---|---|
level | String |
The maximum level of log message the log handler records.
|
encoding | String |
The character encoding scheme to be used for the output.
|
formatter | String |
The log formatter used by this log handler.
|
target | String |
The system output stream where the output of the log handler goes. This can be System.err or System.out for the system error stream or standard out stream respectively.
|
autoflush | Boolean |
If set to true the log messages will be sent to the handlers target immediately upon receipt.
|
name | String |
The unique identifier for this log handler.
|
enabled | Boolean |
If set to
true , the handler is enabled and functioning as normal. If set to false , the handler is ignored when processing log messages.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.4. File Log Handler Properties
Table 13.9. File Log Handler Properties
Property | Datatype | Description |
---|---|---|
level | String |
The maximum level of log message the log handler records.
|
encoding | String |
The character encoding scheme to be used for the output.
|
formatter | String |
The log formatter used by this log handler.
|
append | Boolean |
If set to true then all messages written by this handler will be appended to the file if it already exists. If set to false a new file will be created each time the application server launches. Changes to
append require a server reboot to take effect.
|
autoflush | Boolean |
If set to true the log messages will be sent to the handlers assigned file immediately upon receipt. Changes to
autoflush require a server reboot to take effect.
|
name | String |
The unique identifier for this log handler.
|
file | Object |
The object that represents the file where the output of this log handler is written to. It has two configuration properties,
relative-to and path .
|
relative-to | String |
This is a property of the file object and is the directory where the log file is written to. JBoss EAP 6 file path variables can be specified here. The
jboss.server.log.dir variable points to the log/ directory of the server.
|
path | String |
This is a property of the file object and is the name of the file where the log messages will be written. It is a relative path name that is appended to the value of the
relative-to property to determine the complete path.
|
enabled | Boolean |
If set to
true , the handler is enabled and functioning as normal. If set to false , the handler is ignored when processing log messages.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.5. Periodic Log Handler Properties
Table 13.10. Periodic Log Handler Properties
Property | Datatype | Description |
---|---|---|
append | Boolean |
If set to true then all messages written by this handler will be appended to the file if it already exists. If set to false a new file will be created each time the application server launches. Changes to append require a server reboot to take effect.
|
autoflush | Boolean |
If set to true the log messages will be sent to the handlers assigned file immediately upon receipt. Changes to autoflush require a server reboot to take effect.
|
encoding | String |
The character encoding scheme to be used for the output.
|
formatter | String |
The log formatter used by this log handler.
|
level | String |
The maximum level of log message the log handler records.
|
name | String |
The unique identifier for this log handler.
|
file | Object |
Object that represents the file where the output of this log handler is written to. It has two configuration properties,
relative-to and path .
|
relative-to | String |
This is a property of the file object and is the directory where the log file is written to. File path variables can be specified here. The
jboss.server.log.dir variable points to the log/ directory of the server.
|
path | String |
This is a property of the file object and is the name of the file where the log messages will be written. It is a relative path name that is appended to the value of the
relative-to property to determine the complete path.
|
suffix | String |
This String is appended to the filename of the rotated logs and is used to determine the frequency of rotation. The format of the suffix is a dot (.) followed by a date String which is parsable by the
java.text.SimpleDateFormat class. The log is rotated on the basis of the smallest time unit defined by the suffix. For example, the suffix .yyyy-MM-dd will result in daily log rotation.
|
enabled | Boolean |
If set to
true , the handler is enabled and functioning as normal. If set to false , the handler is ignored when processing log messages.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.6. Size Log Handler Properties
Table 13.11. Size Log Handler Properties
Property | Datatype | Description |
---|---|---|
append | Boolean |
If set to true then all messages written by this handler will be appended to the file if it already exists. If set to false a new file will be created each time the application server launches. Changes to append require a server reboot to take effect.
|
autoflush | Boolean |
If set to true the log messages will be sent to the handlers assigned file immediately upon receipt. Changes to append require a server reboot to take effect.
|
encoding | String |
The character encoding scheme to be used for the output.
|
formatter | String |
The log formatter used by this log handler.
|
level | String |
The maximum level of log message the log handler records.
|
name | String |
The unique identifier for this log handler.
|
file | Object |
Object that represents the file where the output of this log handler is written to. It has two configuration properties,
relative-to and path .
|
relative-to | String |
This is a property of the file object and is the directory where the log file is written to. File path variables can be specified here. The
jboss.server.log.dir variable points to the log/ directory of the server.
|
path | String |
This is a property of the file object and is the name of the file where the log messages will be written. It is a relative path name that is appended to the value of the
relative-to property to determine the complete path.
|
rotate-size | Integer |
The maximum size that the log file can reach before it is rotated. A single character appended to the number indicates the size units:
b for bytes, k for kilobytes, m for megabytes, g for gigabytes. Eg. 50m for 50 megabytes.
|
max-backup-index | Integer |
The maximum number of rotated logs that are kept. When this number is reached, the oldest log is reused.
|
enabled | Boolean |
If set to
true , the handler is enabled and functioning as normal. If set to false , the handler is ignored when processing log messages.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.5.7. Async Log Handler Properties
Table 13.12. Async Log Handler Properties
Property | Datatype | Description |
---|---|---|
level | String |
The maximum level of log message the log handler records.
|
name | String |
The unique identifier for this log handler.
|
queue-length | Integer |
Maximum number of log messages that will be held by this handler while waiting for sub-handlers to respond.
|
overflow-action | String |
How this handler responds when its queue length is exceeded. This can be set to
BLOCK or DISCARD . BLOCK makes the logging application wait until there is available space in the queue. This is the same behaviour as an non-async log handler. DISCARD allows the logging application to continue but the log message is deleted.
|
subhandlers | String[] |
This is the list of log handlers to which this async handler passes its log messages.
|
enabled | Boolean |
If set to
true , the handler is enabled and functioning as normal. If set to false , the handler is ignored when processing log messages.
|
filter-spec | String |
An expression value that defines a filter. The following expression defines a filter that does not match a pattern:
not(match("JBAS.*"))
|
13.6. Sample XML Configuration for Logging
13.6.1. Sample XML Configuration for the Root Logger
<subsystem xmlns="urn:jboss:domain:logging:1.2"> <root-logger> <level name="INFO"/> <handlers> <handler name="CONSOLE"/> <handler name="FILE"/> </handlers> </root-logger> </subsystem>
13.6.2. Sample XML Configuration for a Log Category
<subsystem xmlns="urn:jboss:domain:logging:1.2"> <logger category="com.company.accounts.rec"> <handlers> <handler name="accounts-rec"/> </handlers> </logger> </subsystem>
13.6.3. Sample XML Configuration for a Console Log Handler
<subsystem xmlns="urn:jboss:domain:logging:1.2"> <console-handler name="CONSOLE"> <level name="INFO"/> <formatter> <pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/> </formatter> </console-handler> </subsystem>
13.6.4. Sample XML Configuration for a File Log Handler
<file-handler name="accounts-rec-trail" autoflush="true"> <level name="INFO"/> <file relative-to="jboss.server.log.dir" path="accounts-rec-trail.log"/> <append value="true"/> </file-handler>
13.6.5. Sample XML Configuration for a Periodic Log Handler
<periodic-rotating-file-handler name="FILE"> <formatter> <pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/> </formatter> <file relative-to="jboss.server.log.dir" path="server.log"/> <suffix value=".yyyy-MM-dd"/> <append value="true"/> </periodic-rotating-file-handler>
13.6.6. Sample XML Configuration for a Size Log Handler
<size-rotating-file-handler name="accounts_debug" autoflush="false"> <level name="DEBUG"/> <file relative-to="jboss.server.log.dir" path="accounts-debug.log"/> <rotate-size value="500k"/> <max-backup-index value="5"/> <append value="true"/> </size-rotating-file-handler>
13.6.7. Sample XML Configuration for a Async Log Handler
<async-handler name="Async_NFS_handlers"> <level name="INFO"/> <queue-length value="512"/> <overflow-action value="block"/> <subhandlers> <handler name="FILE"/> <handler name="accounts-record"/> </subhandlers> </async-handler>
Chapter 14. JVM
14.1. About JVM
14.1.1. About JVM Settings
host.xml
and domain.xml
configuration files, and determined by the domain controller components responsible for starting and stopping server processes. In a standalone server instance, the server startup processes can pass command line settings at startup. These can be declared from the command line or via the System Properties screen in the Management Console.
An important feature of the managed domain is the ability to define JVM settings at multiple levels. You can configure custom JVM settings at the host level, by server group, or by server instance. The more specialized child elements will override the parent configuration, allowing for the declaration of specific server configurations without requiring exclusions at the group or host level. This also allows the parent configuration to be inherited by the other levels until settings are either declared in the configuration files or passed at runtime.
Example 14.1. JVM settings in the domain configuration file
domain.xml
configuration file.
<server-groups> <server-group name="main-server-group" profile="default"> <jvm name="default"> <heap size="64m" max-size="512m"/> </jvm> <socket-binding-group ref="standard-sockets"/> </server-group> <server-group name="other-server-group" profile="default"> <jvm name="default"> <heap size="64m" max-size="512m"/> </jvm> <socket-binding-group ref="standard-sockets"/> </server-group> </server-groups>
main-server-group
is declaring a heap size of 64 megabytes, and a maximum heap size of 512 megabytes. Any server that belongs to this group will inherit these settings. You can change these settings for the group as a whole, by the host, or the individual server.
Example 14.2. Domain settings in the host configuration file
host.xml
configuration file.
<servers> <server name="server-one" group="main-server-group" auto-start="true"> <jvm name="default"/> </server> <server name="server-two" group="main-server-group" auto-start="true"> <jvm name="default"> <heap size="64m" max-size="256m"/> </jvm> <socket-binding-group ref="standard-sockets" port-offset="150"/> </server> <server name="server-three" group="other-server-group" auto-start="false"> <socket-binding-group ref="standard-sockets" port-offset="250"/> </server> </servers>
server-two
belongs to the server group named main-server-group
, inheriting the JVM settings from the default
JVM group. In the previous example, the main heap size for main-server-group
was set at 512 megabytes. By declaring the lower maximum heap size of 256 megabytes, server-two
can override the domain.xml
settings to fine-tune performance as desired.
The JVM settings for standalone server instances can be declared at runtime by setting the JAVA_OPTS
environment variable before starting the server. An example of setting the JAVA_OPTS
environment variable at the Linux command-line is:
[user@host bin]$ export JAVA_OPTS="-Xmx1024M"
C:\> set JAVA_OPTS="Xmx1024M"
standalone.conf
file found in the EAP_HOME/bin
folder, which contains examples of options to pass to the JVM.
14.1.2. Display the JVM Status in the Management Console
Prerequisites
Table 14.1. JVM Status Attributes
Type | Description |
---|---|
Max | The maximum amount of memory in bytes that can be used for memory management. |
Used | The amount of used memory in mega bytes. |
Committed | The amount of memory in bytes that is committed for the Java virtual machine to use. |
Init | The amount of memory in bytes that the Java virtual machine initially requests from the operating system for memory management. |
Procedure 14.1. Display the JVM Status in the Management Console
Display the JVM status
You can view the JVM status in either the standalone server instance or a managed domain.Display the JVM status for a standalone server instance
Select JVM Status from the Server Status menu on the Runtime screen.Figure 14.1. JVM status for a standalone server instance
Display the JVM status for a managed domain
Select JVM Status from the Domain Status menu on the Runtime screen.- The managed domain can provide visibility of all server instances in the server group, but will only allow you to view one server at a time by selecting from the server menu. To view the status of other servers in your server group, click on the drop-down box at the top left of the screen to select from the host and servers displayed in your group and click the Done button to load the results.
The status of the JVM settings for the server instance are displayed.
Chapter 15. Web Subsystem
15.1. Configure the Web Subsystem
To configure the Web Subsystem using the web-based Management Console, click the Profile(s) tab at the top right. For a managed domain, select the server profile you wish to configure from the Profile selection box at the top left. Expand the Subsystems menu, then expand the Web menu. Each configurable part of the Web subsystem is shown.
Note
ha
or full-ha
, in a managed domain, or if you start your standalone server with the standalone-ha
or standalone-full-ha
profile. mod_cluster configuration is covered in Section 16.5.2, “Configure the mod_cluster
Subsystem”.
To configure the JSP Container, HTTP connectors, and virtual HTTP servers, click the Servlet/HTTP menu entry. Click the Edit button to change any values. Click the Advanced button to view advanced options. The options are explained below. Options for HTTP connectors and virtual servers are shown in separate tables.
Table 15.1. Servlet/HTTP Configuration Options
Option | Description | CLI Command |
---|---|---|
Disabled? |
If
true , disables the Java ServerPages (JSP) container. Defaults to false . This is useful if you do not use any Java ServerPages (JSPs).
|
/profile=full-ha/subsystem=web/configuration=jsp-configuration/:write-attribute(name=disabled,value=false) |
Development? |
If true, enables Development Mode, which produces more verbose debugging information. Defaults to
false .
|
/profile=full-ha/subsystem=web/configuration=jsp-configuration/:write-attribute(name=development,value=false) |
Keep Generated? |
Click Advanced to see this option, if it is hidden. If
true keeps generated Servlets. Enabled by default.
|
/profile=full-ha/subsystem=web/configuration=jsp-configuration/:write-attribute(name=keep-generated,value=true) |
Check Interval? |
Click Advanced to see this option, if it is hidden. A value in seconds, which determines how often to check for JSP updates using a background process. Defaults to
0 .
|
/profile=full-ha/subsystem=web/configuration=jsp-configuration/:write-attribute(name=check-interval,value=0) |
Display Source? |
Click Advanced to see this option, if it is hidden. If
true , the JSP source fragment is displayed when a runtime error occurs. Defaults to true .
|
/profile=full-ha/subsystem=web/configuration=jsp-configuration/:write-attribute(name=display-source-fragment,value=true) |
mod_cluster
, mod_jk
, mod_proxy
, ISAPI
, and NSAPI
for load balancing and HA clustering. To configure a connector, select the Connectors tab and click Add. To remove a connector, select its entry and click Remove. To edit a connector, select its entry and click Edit.
Example 15.1. Create a New Connector
/profile=full-ha/subsystem=web/connector=ajp/:add(socket-binding=ajp,scheme=http,protocol=AJP/1.3,secure=false,name=ajp,max-post-size=2097152,enabled=true,enable-lookups=false,redirect-port=8433,max-save-post-size=4096)
Table 15.2. Connector Options
Option | Description | CLI Command |
---|---|---|
Name |
A unique name for the connector, for display purposes.
|
/profile=full-ha/subsystem=web/connector=ajp/:read-attribute(name=name) |
Socket Binding |
The named socket binding the connector should bind to. A socket binding is a mapping between a socket name and a network port. Socket bindings are configured for each standalone server, or via socket binding groups in a managed domain. A socket binding group is applied to a server group.
|
/profile=full-ha/subsystem=web/connector=ajp/:write-attribute(name=socket-binding,value=ajp) |
Scheme |
The web connector scheme, such as HTTP or HTTPS.
|
/profile=full-ha/subsystem=web/connector=ajp/:write-attribute(name=scheme,value=http) |
Protocol |
The web connector protocol to use, such as AJP or HTTP.
|
/profile=full-ha/subsystem=web/connector=ajp/:write-attribute(name=protocol,value=AJP/1.3) |
Enabled |
Whether or not this web connector is enabled.
|
/profile=full-ha/subsystem=web/connector=ajp/:write-attribute(name=enabled,value=true) |
Example 15.2. Add a New Virtual Server
/profile=full-ha/subsystem=web/virtual-server=default-host/:add(enable-welcome-root=true,default-web-module=ROOT.war,alias=["localhost","example.com"],name=default-host)
Table 15.3. Virtual Servers Options
Option | Description | CLI Command |
---|---|---|
Name |
A unique name for the virtual server, for display purposes.
| |
Alias |
A list of hostnames which should match this virtual server. In the Management Console, use one hostname per line.
|
/profile=full-ha/subsystem=web/virtual-server=default-host/:write-attribute(name=alias,value=["localhost","example.com"]) |
Default Module |
The module whose web application should be deployed at the root node of this virtual server, and will be displayed when no directory is given in the HTTP request.
|
/profile=full-ha/subsystem=web/virtual-server=default-host/:write-attribute(name=default-web-module,value=ROOT.war) |
To configure Web Services options, click the Web Services menu item. The options are explained in the table below.
Table 15.4. Web Services Configuration Options
Option | Description | CLI Command |
---|---|---|
Modify WSDL Address |
Whether the WSDL address can be modified by applications. Defaults to
true .
|
/profile=full-ha/subsystem=webservices/:write-attribute(name=modify-wsdl-address,value=true) |
WSDL Host |
The WSDL contract of a JAX-WS Web Service includes a <soap:address> element which points to the location of the endpoint. If the value of <soap:address> is a valid URL, it is not overwritten unless
modify-wsdl-address is set to true . If the value of <soap:address> is not a valid URL, it is overwritten using the values of wsdl-host and either wsdl-port or wsdl-secure-port . If wsdl-host is set to jbossws.undefined.host , the requester's host address is used when the <soap-address> is rewritten. Defaults to ${jboss.bind.address:127.0.0.1} , which uses 127.0.0.1 if no bind address is specified when JBoss EAP 6 is started.
|
/profile=full-ha/subsystem=webservices/:write-attribute(name=wsdl-host,value=127.0.0.1) |
WSDL Port |
The non-secure port that is used to rewrite the SOAP address. If this is set to
0 (the default), the port is identified by querying the list of installed connectors.
|
/profile=full-ha/subsystem=webservices/:write-attribute(name=wsdl-port,value=80) |
WSDL Secure Port |
The secure port that is used to rewrite the SOAP address. If this is set to
0 (the default), the port is identified by querying the list of installed connectors.
|
/profile=full-ha/subsystem=webservices/:write-attribute(name=wsdl-secure-port,value=443) |
15.2. Replace the Default Welcome Web Application
Procedure 15.1. Replace the Default Welcome Web Application With Your Own Web Application
Disable the Welcome application.
Use the Management CLI scriptEAP_HOME/bin/jboss-cli.sh
to run the following command. You may need to change the profile to modify a different managed domain profile, or remove the/profile=default
portion of the command for a standalone server./profile=default/subsystem=web/virtual-server=default-host:write-attribute(name=enable-welcome-root,value=false)
Configure your Web application to use the root context.
To configure your web application to use the root context (/) as its URL address, modify itsjboss-web.xml
, which is located in theMETA-INF/
orWEB-INF/
directory. Replace its<context-root>
directive with one that looks like the following.<jboss-web> <context-root>/</context-root> </jboss-web>
Deploy your application.
Deploy your application to the server group or server you modified in the first step. The application is now available onhttp://SERVER_URL:PORT/
.
Chapter 16. HTTP Clustering and Load Balancing
16.1. Introduction
16.1.1. About High-Availability and Load Balancing Clusters
- Instances of the Application Server
- Web applications, when used in conjunction with the internal JBoss Web server, Apache HTTPD, Microsoft IIS, or Oracle iPlanet Web Server.
- Stateful, stateless, and entity Enterprise JavaBeans (EJBs)
- Single Sign On (SSO) Mechanisms
- Distributed cache
- HTTP sessions
- JMS services and Message-driven beans (MDBs)
16.1.2. Components Which Can Benefit from High Availability
Several instances of JBoss EAP 6 (running as a standalone server) or a server group's members (running as part of a managed domain) can be configured to be highly available. This means that if one instance or member is stopped or disappears from the cluster, its work load is moved to a peer. The work load can be managed in such a way to provide load-balancing functionality as well, so that servers or server groups with more or better resources can take on a larger portion of the work load, or additional capacity can be added during times of high load.
The web server itself can be clustered for HA, using one of several compatible load balancing mechanisms. The most flexible is mod_cluster
connector, which is tightly integrated with the JBoss EAP 6 container. Other choices include Apache mod_jk
or mod_proxy
connectors, or the ISAPI and NSAPI connectors.
Deployed applications can be made highly-available because of the Java Enterprise Edition 6 (Java EE 6) specification. Stateless or stateful session EJBs can be clustered so that if the node which is involved in the work disappears, another node can take over, and in the case of stateful session beans, preserve the state.
16.1.3. Overview of HTTP Connectors
Table 16.1. HTTP connector features and constraints
Connector | Web server | Supported operating systems | Supported protocols | Adapts to deployment status | Supports sticky session |
---|---|---|---|---|---|
mod_cluster | JBoss Enterprise Web Server HTTPD, Native HTTPD (Red Hat Enterprise Linux, Hewlett-Packard HP-UX) | Red Hat Enterprise Linux, Microsoft Windows Server, Oracle Solaris, Hewlett-Packard HP-UX | HTTP, HTTPS, AJP | Yes. Detects deployment and undeployment of applications and dynamically decides whether to direct client requests to a server based on whether the application is deployed on that server. | Yes |
mod_jk | JBoss Enterprise Web Server HTTPD, Native HTTPD (Red Hat Enterprise Linux, Hewlett-Packard HP-UX) | Red Hat Enterprise Linux, Microsoft Windows Server, Oracle Solaris, Hewlett-Packard HP-UX | AJP | No. Directs client requests to the container as long as the container is available, regardless of application status. | Yes |
mod_proxy | JBoss Enterprise Web Server HTTPD | Red Hat Enterprise Linux, Microsoft Windows Server, Oracle Solaris | HTTP, HTTPS, AJP | No. Directs client requests to the container as long as the container is available, regardless of application status. | Yes |
ISAPI | Microsoft IIS | Microsoft Windows Server | AJP | No. Directs client requests to the container as long as the container is available, regardless of application status. | Yes |
NSAPI | Oracle iPlanet Web Server | Oracle Solaris | AJP | No. Directs client requests to the container as long as the container is available, regardless of application status. | Yes |
Learn more about each HTTP Connector
16.1.4. Worker Node
A worker node, sometimes referred to as simply a node, is a JBoss EAP 6 server which accepts requests from one or more client-facing HTTPD servers. JBoss EAP 6 can accept requests from its own HTTPD, the HTTPD shipped with JBoss Enterprise Web Server, Apache HTTPD, Microsoft IIS, or Oracle iPlanet Web Server (Formerly Netscape Web Server).
A cluster node is a member of a cluster of servers. Such a cluster may be load-balancing, high-availability, or both. In a load-balancing cluster, a central manager distributes work loads amongst its nodes equally, by some situation-specific measurement of equality. In a high-availability cluster, some nodes are actively doing work, and others are waiting to step in if one of the active nodes leaves the cluster.
16.2. Connector Configuration
16.2.1. Define Thread Pools for HTTP Connector in JBoss EAP 6
Thread Pools in JBoss EAP 6 can be shared between different components using the Executor model. These pools can be shared not only by different (HTTP) connectors, but also by other components within JBoss EAP 6 that support the Executor model. Getting the HTTP connector thread pool to match your current web performance requirements is a tricky art and requires close monitoring of the current thread pool and the current and anticipated web load demands. In this task, you will learn how to set the a thread pool for an HTTP Connector using the Executor model. You will learn how to set this using both the Command Line Interface and by modifying the XML configuration file.
Procedure 16.1. Setup a thread pool for an HTTP Connector
Define a thread factory
Open up your configuration file (standalone.xml
if modifying for a standalone server ordomain.xml
if modifying for a domain based configuration. This file will be in theEAP_HOME/standalone/configuration
or theEAP_HOME/domain/configuration
folder).Add the following subsystem entry, changing the values to suit your server needs.<subsystem xmlns="urn:jboss:domain:threads:1.0"> <thread-factory name="http-connector-factory" thread-name-pattern="HTTP-%t" priority="9" group-name="uq-thread-pool"/> </subsystem>
If you prefer to use the CLI to do this task, then execute the following command in a CLI command prompt:[standalone@localhost:9999 /] ./subsystem=threads/thread-factory=http-connector-factory:add(thread-name-pattern="HTTP-%t", priority="9", group-name="uq-thread-pool")
Create an executor
You can use one of six in-built executor classes to act as the executor for this factory. The six executors are:unbounded-queue-thread-pool
,bounded-queue-thread-pool
,blocking-bounded-queue-thread-pool
,queueless-thread-pool
,blocking-queueless-thread-pool
andscheduled-thread-pool
.In this example, we will use theunbounded-queue-thread-pool
to act as the executor. Modify the values ofmax-threads
andkeepalive-time
parameters to suit your server needs.<unbounded-queue-thread-pool name="uq-thread-pool"> <thread-factory name="http-connector-factory" /> <max-threads count="10" /> <keepalive-time time="30" unit="seconds" /> </unbounded-queue-thread-pool>
Or if you prefer to use the CLI:[standalone@localhost:9999 /] ./subsystem=threads/unbounded-queue-thread-pool=uq-thread-pool:add(thread-factory="http-connector-factory", keepalive-time={time=30, unit="seconds"}, max-threads=30)
Make the HTTP web connector use this thread pool
In the same configuration file, locate the HTTP connector element under the web subsystem and modify it to use the thread pool defined in the previous steps.<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http" executor="uq-thread-pool" />
Again, if you prefer to use the CLI:[standalone@localhost:9999 /] ./subsystem=web/connector=http:write-attribute(name=executor, value="uq-thread-pool")
Restart the server
Restart the server (standalone or domain) so that the changes can take effect. Use the following CLI commands to confirm if the changes from the steps above have taken place:[standalone@localhost:9999 /] ./subsystem=threads:read-resource(recursive=true) { "outcome" => "success", "result" => { "blocking-bounded-queue-thread-pool" => undefined, "blocking-queueless-thread-pool" => undefined, "bounded-queue-thread-pool" => undefined, "queueless-thread-pool" => undefined, "scheduled-thread-pool" => undefined, "thread-factory" => {"http-connector-factory" => { "group-name" => "uq-thread-pool", "name" => "http-connector-factory", "priority" => 9, "thread-name-pattern" => "HTTP-%t" }}, "unbounded-queue-thread-pool" => {"uq-thread-pool" => { "keepalive-time" => { "time" => 30L, "unit" => "SECONDS" }, "max-threads" => 30, "name" => "uq-thread-pool", "thread-factory" => "http-connector-factory" }} } } [standalone@localhost:9999 /] ./subsystem=web/connector=http:read-resource(recursive=true) { "outcome" => "success", "result" => { "configuration" => undefined, "enable-lookups" => false, "enabled" => true, "executor" => "uq-thread-pool", "max-connections" => undefined, "max-post-size" => 2097152, "max-save-post-size" => 4096, "name" => "http", "protocol" => "HTTP/1.1", "proxy-name" => undefined, "proxy-port" => undefined, "redirect-port" => 443, "scheme" => "http", "secure" => false, "socket-binding" => "http", "ssl" => undefined, "virtual-server" => undefined } }
You have successfully created a thread factory and an executor and modified your HTTP Connector to use this thread pool.
16.3. HTTPD Configuration
16.3.1. About the Stand-Alone HTTPD
16.3.2. Install the Apache HTTPD included with JBoss EAP 6
Prerequisites
- You need root or administrator access to complete this task.
- The Apache Portability Runtime (APR) must be installed. In Red Hat Enterprise Linux, install one of the following packages:
apr-devel
orapr-util-devel
. If you use a different operating system, refer to the Apache Portability Runtime website at http://apr.apache.org/ to fulfill this requirement.
Procedure 16.2. Install the Apache HTTPD
Navigate to the JBoss EAP downloads list for your platform, on the Red Hat Customer Service Portal.
Log in to the Red Hat Customer Service Portal at https://access.redhat.com. Using the menus at the top, choose Downloads, JBoss Enterprise Middleware, Downloads. Select Application Platform from theProduct
list. Select the version of JBoss EAP to see available downloads for that version.Choose the HTTPD binary from the list.
Find the HTTPD binary for your operating system and architecture. Click the Download link. A ZIP file containing the HTTPD distribution downloads to your computer.Extract the ZIP to the system where the HTTPD binary will run.
Extract the ZIP file on your preferred server, to a temporary location. The ZIP file will contain thehttpd
directory under a jboss-ews-version-number folder. Copy thehttpd
folder and place it inside the directory where you installed the JBoss EAP 6, commonly referred to as EAP_HOME.Your HTTPD would now be located inEAP_HOME/httpd/
directory. You can now use this location for HTTPD_HOME, as found in other JBoss EAP 6 documentation.Run the Post-Installation script and create apache user and group accounts
On a shell prompt, switch to the root user account, navigate to theEAP_HOME/httpd
directory and execute the following command../.postinstall
Next, check to see if a user called apache exists on the system by running the following command:id apache
If the user does not exist then it will need to be added, along with the appropriate usergroup. In order to achieve this, execute the following:/usr/sbin/groupadd -g 91 -r apache 2> /dev/null || : /usr/sbin/useradd -c "Apache" -u 48 \ -s /sbin/nologin -r apache 2> /dev/null || :
Once this is completed, if theapache
user will be running the httpd service, then the ownership of the HTTP directories will need to be changed to reflect this:chown -R apache:apache httpd
To test that the above commands have been successful, check that theapache
user has execution permission to the HTTP server install path.ls -l
The output should be similar to:drwxrwxr-- 11 apache apache 4096 Feb 14 06:52 httpd
Configure the HTTPD.
Switch to the new user account using the following commandsudo su apache
and then configure HTTPD as theapache
user to meet the needs of your organization. You can use the documentation available from the Apache Foundation at http://httpd.apache.org/ for general guidance.Start the HTTPD.
Start the HTTPD using the following command:EAP_HOME/httpd/sbin/apachectl start
Stop the HTTPD.
To stop the HTTPD, issue the following command:EAP_HOME/httpd/sbin/apachectl stop
16.3.3. mod_cluster Configuration on httpd
mod_cluster is an httpd-based load balancer. It uses a communication channel to forward requests from httpd to one of a set of application server nodes. The following derivatives can be set to configure mod_cluster on httpd.
Note
Table 16.2. mod_cluster Derivatives
Derivative | Description | Values |
---|---|---|
CreateBalancers | Defines how the balancers are created in the httpd VirtualHosts. This allows directives like: ProxyPass /balancer://mycluster1/ . |
0: Create all VirtualHosts defined in httpd
1: Do not create balancers (at least one ProxyPass or ProxyMatch is required to define the balancer names)
2: Create only the main server
Default: 2
While using the value 1, do not forget to configure the balancer in the ProxyPass directive, because the default is an empty stickysession and
nofailover=Off and the values received via the MCMP CONFIG message are ignored.
|
UseAlias | Check that the alias corresponds to the server name. |
0: Ignore aliases
1: Check aliases
Default: 0
|
LBstatusRecalTime | Time interval in seconds for loadbalancing logic to recalculate the status of a node. |
Default: 5 seconds
|
WaitForRemove | Time in seconds before a removed node is forgotten by httpd. |
Default: 10 seconds
|
ProxyPassMatch/ProxyPass |
ProxyPassMatch and ProxyPass are mod_proxy directives which, when using
! (instead of the back-end url), prevent reverse-proxy in the path. This is used to allow httpd to serve static information like images. For example,
ProxyPassMatch ^(/.*\.gif)$ !
The above example allows httpd to serve the .gif files directly.
|
The context of a mod_manger directive is VirtualHost in all cases, except when mentioned otherwise. server config
context implies that the directive must be outside a VirtualHost configuration. If not, an error message is displayed and httpd does not start.
Table 16.3. mod_manager Derivatives
Derivative | Description | Values |
---|---|---|
EnableMCPMReceive | Allow the VirtualHost to receive the MCPM from the nodes. Include EnableMCPMReceive in the httpd configuration to allow mod_cluster to work. Save it in the VirtualHost where you configure advertise. | |
MemManagerFile |
The base name for the names that mod_manager uses to store configuration, generate keys for shared memory or locked files. This must be an absolute path name; the directories are created if needed. It is recommended that these files are placed on a local drive and not an NFS share.
Context: server config
| $server_root/logs/
|
Maxcontext | The maximum number of contexts supported by mod_cluster
Context: server config
|
Default: 100
|
Maxnode | The maximum number of nodes supported by mod_cluster.
Context: server config
|
Default: 20
|
Maxhost | The maximum number of hosts (aliases) supported by mod_cluster. It also includes the maximum number of balancers.
Context: server config
| 10 |
Maxsessionid |
The number of active sessionid stored to provide the number of active sessions in the mod_cluster-manager handler. A session is inactive when mod_cluster does not receive any information from the session within 5 minutes.
Context: server config
This field is for demonstration and debugging purposes only.
| 0: the logic is not activated. |
MaxMCMPMaxMessSize | The maximum size of MCMP messages from other Max directives | Calculated from other Max directives. Min: 1024 |
ManagerBalancerName | The name of balancer to use when the JBoss AS/JBossWeb/Tomcat does not provide a balancer name. | mycluster
|
PersistSlots | Tells mod_slotmem to persist nodes, aliases and contexts in files.
Context: server config
| Off |
CheckNonce | Switch check of nonce when using mod_cluster-manager handler. |
on/off
Default: on - Nonce checked
|
AllowDisplay | Switch additional display on mod_cluster-manager main page. |
on/off
Default: off - only version is displayed
|
AllowCmd | Allow commands using mod_cluster-manager URL. |
on/off
Default: on - Commands allowed
|
ReduceDisplay | Reduce the information displayed on the main mod_cluster-manager page, so that more number of nodes can be displayed on the page. |
on/off
Default: off - full information is displayed
|
SetHandler mod_cluster-manager |
Displays information about the node that mod_cluster sees from the cluster. The information includes generic information and additionally counts the number of active sessions.
<Location /mod_cluster-manager> SetHandler mod_cluster-manager Order deny,allow Allow from 127.0.0.1 </Location> |
on/off
Default: off
|
Note
16.3.4. Use an External HTTPD as the Web Front-end for JBoss EAP 6 Applications
For reasons to use an external HTTPD as the web front-end, as well as advantages and disadvantages of the different HTTP connectors supported by JBoss EAP 6, refer to Section 16.1.3, “Overview of HTTP Connectors”. In some situations, you can use the HTTPD that comes with your operating system. Otherwise, you can use the HTTPD that ships as part of JBoss Enterprise Web Server.
16.3.5. Configure JBoss EAP 6 to Accept Requests From an External HTTPD
JBoss EAP 6 does not need to know which proxy it is accepting requests from, only the port and protocol to look for. This is not true of mod_cluster
, which is more tightly coupled to the configuration of JBoss EAP 6. But the following task works for mod_jk
, mod_proxy
, ISAPI
, and NSAPI
. Substitute the protocols and ports you need to configure with the ones in the examples.
mod_cluster
, refer to Section 16.5.5, “Configure a mod_cluster Worker Node”.
Prerequisites
- You need to be logged into the Management CLI or Management Console to perform this task. The exact steps in the task use the Management CLI, but the same basic procedure is used in the Management Console.
- You need a list of which protocols you will be using, whether HTTP, HTTPS, or AJP.
Procedure 16.3. Edit Configuration and add Socket Bindings
Configure the
jvmRoute
anduseJK
system properties.By default, the jvmRoute is set to the same value as the server name. If you need to customize it, you can use a command like the following. Replace or remove the/profile=ha
portion of the command, depending on which profile you use or whether you use a standalone server. Replace the stringCUSTOM_ROUTE_NAME
with your custom jvmRoute name.[user@localhost:9999 /]
/profile=ha/subsystem=web:write-attribute(name="instance-id",value=
"CUSTOM_ROUTE_NAME"
)Enable theuseJK
value by setting it totrue
by using the following command:[user@localhost:9999 /]
/system-property=UseJK/:add(value=true)
List the connectors available in the web subsystem.
Note
This step is only necessary if you are not using thestandalone-ha.xml
configuration for a standalone server, or theha
orfull-ha
profiles for a server group in a managed domain. Those configurations already include all of the necessary connectors.In order for an external HTTPD to be able to connect to JBoss EAP 6's web server, the web subsystem needs a connector. Each protocol needs its own connector, which is tied to a socket group.To list the connectors currently available, issue the following command:[standalone@localhost:9999 /]
/subsystem=web:read-children-names(child-type=connector)
If there is no line indicating the connector your need (HTTP, HTTPS, AJP), you need to add the connector.Read the configuration of a connector.
To see the details of how a connector is configured, you can read its configuration. The following command reads the configuration of the AJP connector. The other connectors have similar configuration output.[standalone@localhost:9999 /]
/subsystem=web/connector=ajp:read-resource(recursive=true)
{ "outcome" => "success", "result" => { "enable-lookups" => false, "enabled" => true, "max-post-size" => 2097152, "max-save-post-size" => 4096, "protocol" => "AJP/1.3", "redirect-port" => 8443, "scheme" => "http", "secure" => false, "socket-binding" => "ajp", "ssl" => undefined, "virtual-server" => undefined } }Add the necessary connectors to the web subsystem.
To add a connector to the web subsystem, it needs to have a socket binding. The socket binding is added to the socket binding group used by your server or server group. The following steps assume that your server group isserver-group-one
and that your socket binding group isstandard-sockets
.Add a socket to the socket binding group.
To add a socket to the socket binding group, issue the following command, replacing the protocol and port with the ones you need.[standalone@localhost:9999 /]
/socket-binding-group=standard-sockets/socket-binding=ajp:add(port=8009)
Add the socket binding to the web subsystem.
Issue the following command to add a connector to the web subsystem, substituting the socket binding name and protocol with the ones you need.[standalone@localhost:9999 /]
/subsystem=web/connector=ajp:add(socket-binding=ajp, protocol="AJP/1.3", enabled=true, scheme="http")
16.4. Clustering
16.4.1. Use TCP Communication for the Clustering Subsystem
TCPPING
protocol stack to your configuration and use it as the default mechanism. These configuration options are available in the command-line based Management CLI.
mod_cluster
subsystem also uses UDP communication by default, and you can choose to use TCP here as well.
16.4.2. Configure the JGroups Subsystem to Use TCP
mod_cluster
subsystem to use TCP as well, refer to Section 16.4.3, “Disable Advertising for the mod_cluster
Subsystem”.
Run the Management CLI.
Launch the Management CLI, using theEAP_HOME/bin/jboss-cli.sh
command in Linux or theEAP_HOME\bin\jboss-cli.bat
command in Microsoft Windows Server. Typeconnect
to connect to the domain controller on the localhost, orconnect IP_ADDRESS
to connect to a domain controller on a remote server.Modify the following script to suit your environment.
Copy the following script into a text editor. If you use a different profile on a managed domain, change the profile name. If you use a standalone server, remove the/profile=full-ha
portion of the commands. Modify the properties listed at the bottom of the command as follows. Each of these properties is optional.- initial_hosts
- A comma-separated list of the hosts which are considered well-known, and will be available to look up the initial membership.
- port_range
- If desired, you can assign a port range. If you assign a port range of 2, and the initial port is 7600, then TCPPING will attempt to contact each host on ports 7600-7601. This property is optional.
- timeout
- An optional timeout value, in milliseconds, for cluster members.
- num_initial_members
- The number of nodes before the cluster is considered to be complete. This property is optional.
cd /profile=full-ha/subsystem=jgroups ./stack=tcpping:add cd stack=tcpping ./transport=TRANSPORT:add(type=TCP,socket-binding=jgroups-tcp) :add-protocol(type=TCPPING) :add-protocol(type=MERGE2) :add-protocol(type=FD_SOCK,socket-binding=jgroups-tcp-fd) :add-protocol(type=FD) :add-protocol(type=VERIFY_SUSPECT) :add-protocol(type=BARRIER) :add-protocol(type=pbcast.NAKACK) :add-protocol(type=UNICAST2) :add-protocol(type=pbcast.STABLE) :add-protocol(type=pbcast.GMS) :add-protocol(type=UFC) :add-protocol(type=MFC) :add-protocol(type=FRAG2) :add-protocol(type=RSVP) cd protocol=TCPPING ./property=initial_hosts/:add(value="HostA[7600],HostB[7600]") ./property=port_range/:add(value=0) ./property=timeout/:add(value=3000) ./property=num_initial_members/:add(value=3) cd ../.. :write-attribute(name=default-stack,value=tcpping)
Run the script in batch mode.
Warning
The servers runnning the profile have to be shutdown before executing the batch file.At the Management CLI prompt, typebatch
and press the Enter key. The prompt changes to include a hash (#
) symbol to indicate that you are in batch mode. This allows you to enter a series of commands. If any one of them fails, the entire operation will be rolled back.Paste the modified script from the previous step, adding an extra newline at the end. Typerun-batch
to run the batch. After all commands have run, the messageThe batch executed successfully
appears.
The TCPPING
stack is now available to the JGroups subsystem. If it is used, the JGroups subsystem uses TCP for all network communication. To configure the mod_cluster
subsystem to use TCP as well, refer to Section 16.4.3, “Disable Advertising for the mod_cluster
Subsystem”.
16.4.3. Disable Advertising for the mod_cluster
Subsystem
mod_cluster
subsystem's balancer uses multicast UDP to advertise its availability to the background workers. If you wish, you can disable advertisement. Use the following procedure to configure this behavior.
Procedure 16.4.
Modify the HTTPD configuration.
Modify the HTTPD configuration to disable server advertising and to use a proxy list instead. The proxy list is configured on the worker, and contains all of themod_cluster
-enabled HTTPD servers the worker can talk to.Themod_cluster
configuration for the HTTPD server is typically located in/etc/httpd/
or theetc/httpd/
directory within the HTTPD installation, if it is installed in a non-standard location. Refer to Section 16.5.3, “Install the mod_cluster Module Into Apache HTTPD or JBoss Enterprise Web Server HTTPD” and Section 16.5.4, “Configure Server Advertisement Properties for Your mod_cluster-enabled HTTPD” for more information about the file itself. Open the file containing the virtual host which listens for MCPM requests (using theEnableMCPMReceive
directive), and disable server advertising by changing theServerAdvertise
directive as follows.ServerAdvertise Off
Disable advertising within the
mod_cluster
subsystem of JBoss EAP 6, and provide a list of proxies.You can disable advertising for themod_cluster
subsystem and provide a list of proxies, by using the web-based Management Console or the command-line Management CLI. The list of proxies is necessary because themod_cluster
subsystem will not be able to automatically discover proxies if advertising is disabled.Management Console
- If you use a managed domain, you can only configure
mod_cluster
in profiles where it is enabled, such as theha
andfull-ha
profiles. - Log in to the Management Console and select the Profiles label at the top right of the screen. If you use a managed domain, select either the
ha
orfull-ha
profile from the Profiles selection box at the top left of the Profiles page. - Click the Subsystems menu to expand it. Expand the Web sub-menu, and select Modcluster.
- Click the Edit button at the top, to edit the options which pertain to the entire
mod_cluster
subsystem. Change the value of Advertise tofalse
. Use the Save button to save the settings. - Click the tab labeled Proxies near the bottom of the screen. Click the Edit button in the Proxies sub-page, and enter a list of proxy servers. The correct syntax is a comma-separated list of
HOSTNAME:PORT
strings, like the following.10.33.144.3:6666,10.33.144.1:6666
Click the Save button to save your changes.
Management CLI
The following two Management CLI commands create the same configuration as the Management Console instructions above. They assume that you run a managed domain and that your server group uses thefull-ha
profile. If you use a different profile, change its name in the commands. If you use a standalone server using thestandalone-ha
profile, remove the/profile=full-ha
portion of the commands./profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=advertise,value=false) /profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=proxy-list,value="10.33.144.3:6666,10.33.144.1:6666")
The HTTPD balancer no longer advertises its presence to worker nodes and UDP multicast is no longer used.
16.5. Web, HTTP Connectors, and HTTP Clustering
16.5.1. About the mod_cluster
HTTP Connector
- mod_cluster Management Protocol (MCMP) is an additional connection between the application server nodes and httpd, used by application server nodes to transmit server-side load balance factors and lifecycle events back to the web container via a custom set of HTTP methods.
- Dynamic configuration of HTTPD proxies allows JBoss EAP 6 to adapt on the fly, with no additional configuration.
- The application servers perform the load-balancing factor calculations. This makes load balancing metrics more accurate than other connectors.
- mod_cluster gives fine-grained application lifecycle control. Each server forwards any web application context lifecycle events to the proxy, informing it to start or stop routing requests for a given context in the server. This prevents end users from seeing 404 errors due to unavailable resources.
- AJP, HTTP or HTTPS with mod_cluster and Apache HTTP can be used.
16.5.2. Configure the mod_cluster
Subsystem
mod_cluster
options are available as part of the Web subsystem configuration area. Click the Profiles tab at the top left. If you use a managed domain, select the correct profile to configure from the Profile selection box at the upper right. By default, the ha
and full-ha
profiles have the mod_cluster
subsystem enabled. If you use a standalone server, you need to use the standalone-ha
or standalone-full-ha
profile to start the server. Click the Web item in the left-hand menu, and choose mod_cluster from the sub-menu. The options are explained in the tables below. Overall configuration is shown first, followed by configuration of sessions, web contexts, proxies, SSL, and Networking. Each of these has its own tab within the mod_cluster configuration screen.
Note
ha
and full-ha
for a managed domain, or standalone-ha
and standalone-full-ha
for a standalone server.
Table 16.4. mod_cluster
Configuration Options
Option | Description | CLI Command |
---|---|---|
Load Balancing Group |
If this is not null, requests are sent to a specific load balancing group on the load balancer. Leave this blank if you do not want to use load balancing groups. This is unset by default.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=load-balancing-group,value=myGroup) |
Balancer |
The name of the balancer. This should match the configuration of the HTTPD proxy.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=balancer,value=myBalancer) |
Advertise Socket |
The name of the socket binding to use for cluster advertising.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=advertise-socket,value=modcluster) |
Advertise Security Key |
A string containing the security key for advertising.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=advertise-security-key,value=myKey) |
Advertise |
Whether or not advertising is enabled. Defaults to
true .
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=advertise,value=true) |
Table 16.5. mod_cluster
Session Configuration Options
Option | Description | CLI Command |
---|---|---|
Sticky Session |
Whether to use sticky sessions for requests. This means that after the client makes a connection to a specific cluster node, further communication is routed to that same node unless it becomes unavailable. This defaults to
true , which is the recommended setting.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=sticky-session,value=true) |
Sticky Session Force |
If
true , a request is not redirected to a new cluster node if its initial node becomes unavailable. Instead, it fails. This defaults to false .
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=sticky-session-force,value=false) |
Sticky Session Remove |
Remove session information on failover. Disabled by default.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=sticky-session-remove,value=false) |
Table 16.6. mod_cluster
Web Context Configuration Options
Option | Description | CLI Command |
---|---|---|
Auto Enable Contexts |
Whether to add new contexts to
mod_cluster by default or not. This defaults to true . If you change the default and need to enable context manually, the Web Application can enable its context using the enable() MBean method, or via the mod_cluster manager, which is a web application which runs on the HTTPD proxy on a named virtual host or port which is specified in that HTTPD's configuration.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=auto-enable-contexts,value=true) |
Excluded Contexts |
A comma-separated list of contexts that
mod_cluster should ignore. If no host is indicated, the host is assumed to be localhost . ROOT indicates the root context of the Web Application. The default value is ROOT,invoker,jbossws,juddi,console .
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=excluded-contexts,value="ROOT,invoker,jbossws,juddi,console") |
Table 16.7. mod_cluster
Proxy Configuration Options
Option | Description | CLI Command |
---|---|---|
Proxy URL |
If defined, this value will be prepended to the URL of MCMP commands.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=proxy-url,value=myhost) |
Proxy List |
A comma-separated list of HTTPD proxy addresses, in the format
hostname:port . This indicates the list of proxies that the mod_cluster process will attempt to communicate with initially.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=proxy-list,value="127.0.0.1,127.0.0.2") |
mod_cluster
By default, mod_cluster
communication happens over an unencrypted HTTP link. If you set the connector scheme to HTTPS
(refer to Table 16.5, “mod_cluster
Session Configuration Options”), the settings below tell mod_cluster
where to find the information to encrypt the connection.
Table 16.8. mod_cluster
SSL Configuration Options
Option | Description | CLI Command |
---|---|---|
ssl |
Whether to enable SSL. Defaults to
false .
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=ssl,value=true) |
Key Alias |
The key alias, which was chosen when the certificate was created.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=key-alias,value=jboss) |
Key Store |
TThe location of the key store containing client certificates
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=key-store,value=System.getProperty("user.home") + "/.keystore") |
Key Store Type |
TThe key store type
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=key-store-type,value=JKS) |
Key Store Provider |
The key store provider
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=key-store-provider,value=IBMJCE) |
Password |
The password, which was chosen when the certificate was created.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=password,value=changeit) |
Trust Algorithm |
The algorithm of the trust manager factory.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=trust-algorithm,value=PKIX) |
Cert File |
The location of the certificate file.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=ca-certificate-file,value=${user.home}/jboss.crt) |
CRL File |
Certificate revocation list file.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=ca-crl-file,value=${user.home}/jboss.crl) |
Max Certificate Length |
The maximum length of a certificate held in the trust store. Defaults to 5.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=trust-max-cert-length,value=5) |
Key File |
The location of the key file for the certificate.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=certificate-key-file,value=${user.home}/.keystore) |
Cipher Suite |
The allowed encryption cipher suite.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=cipher-suite,value=ALL) |
Certificate Encoding Algorithms |
The algorithm of the key manager factory.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=encoding-algorithms,value=ALL) |
Revocation URL |
The URL of the Certificate Authority revocation list.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=ca-revocation-url,value=jboss.crl) |
Protocol |
The SSL protocols which are enabled.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/ssl=configuration/:write-attribute(name=protocol,value=SSLv3) |
mod_cluster
Networking Options
The available mod_cluster
networking options control several different timeout behaviors for different types of services that the mod_cluster
service communicates with.
Table 16.9. mod_cluster
Networking Configuration Options
Option | Description | CLI Command |
---|---|---|
Node Timeout |
Timeout (in seconds) for proxy connections to a node. That is the time
mod_cluster will wait for the back-end response before returning error. That corresponds to timeout in the worker mod_proxy documentation. A value of -1 indicates no timeout. Note that mod_cluster always uses a cping/cpong before forwarding a request and the connectiontimeout value used by mod_cluster is the ping value.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=node-timeout,value=-1) |
Socket Timeout |
Number of milliseconds to wait for a response from an httpd proxy to MCMP commands before timing out, and flagging the proxy as in error.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=socket-timeout,value=20) |
Stop Context Timeout |
The amount of time, measure in units specified by stopContextTimeoutUnit, for which to wait for clean shutdown of a context (completion of pending requests for a distributable context; or destruction/expiration of active sessions for a non-distributable context).
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=stop-context-timeout,value=10) |
Session Draining Strategy |
Whether to drain sessions before undeploying a web application.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=session-draining-strategy,value=DEFAULT) |
Max Attempts |
Number of times an HTTPD proxy will attempt to send a given request to a worker before giving up. The minimum value is
1 , meaning try only once. The mod_proxy default is also 1, which means that no retry occurs.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=max-attempts,value=1) |
Flush Packets |
Whether or not to enable packet flushing to the HTTPD server. Defaults to
false .
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=flush-packets,value=false) |
Flush Wait |
How long, in seconds, to wait before flushing packets to the HTTPD server. Defaults to
-1 . A value of -1 means to wait forever before flushing packets.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=flush-wait,value=-1) |
Ping |
How long, in seconds, to wait for a response to a ping from a cluster node. Defaults to
10 seconds.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=ping,value=10) |
SMAX |
Soft maximum idle connection count (the same as
smax in worker mod_proxy documentation). The maximum value depends on the httpd thread configuration, and can be either ThreadsPerChild or 1 .
|
profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=smax,value=ThreadsPerChild) |
TTL |
Time to live (in seconds) for idle connections above smax, default is 60
When
nodeTimeout is not defined the ProxyTimeout directive Proxy is used. If ProxyTimeout is not defined the server timeout Timeout is used. This defaults to 300 seconds. nodeTimeout , ProxyTimeout , and Timeout are set at the socket level.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=ttl,value=-1) |
Node Timeout |
How long, in seconds, to wait for an available worker process from the external HTTPD server to process a request. Defaults to
-1 , which means that mod_cluster waits indefinitely for the HTTPD worker to process the request.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=node-timeout,value=-1) |
mod_cluster
Load Provider Configuration Options
The following mod_cluster
configuration options are not available in the web-based Management Console, but can only be set using the command-line Management CLI.
1
, and distributes work evenly without taking any sort of load balancing algorithm into account. To add it, use the following CLI command: /profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/simple-load-provider:add
busyness
as the determining factor. The list of possible factors is shown below. You can create your own load provider to suit your own environment, as well. The following options of the dynamic load provider can be changed. Note that you can have more than one of these factors (metric) at anytime by simply adding them via the CLI.
:add-metric(type=cpu)
Table 16.10. mod_cluster
Dynamic Load Provider Options
Option | Description | CLI Command |
---|---|---|
Decay |
The factor by which historical metrics should decay in significance.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/:write-attribute(name=decay,value=2) |
History |
The number of historic load metric records to consider when determining the load.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/:write-attribute(name=history,value=9) |
Load Metric |
The only load metric included with the dynamic load provider in JBoss EAP 6 is
busyness , which tries to send each new request to the least busy worker. You can set the capacity of your worker (1 means 100% capacity) and the weight assigned to the busyness metric overall.
|
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/load-metric=busyness/:write-attribute(name=capacity,value=1.0) /profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/load-metric=busyness/:write-attribute(name=type,value=busyness) /profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/load-metric=busyness/:write-attribute(name=weight,value=1) |
Load Metric Algorithms
- cpu
- The cpu load metric uses average CPU load to determine which cluster node receives the next work load.
- mem
- The mem load metric uses free native RAM as a load factor. Usage of this metric is discouraged because it provides a value that includes buffers and cache, so it is always a very low figure on every decent system with a good memory management.
- heap
- The heap load metric uses the heap usage to determine which cluster receives the next work load.
- sessions
- The session load metric uses the number of active sessions as a metric.
- requests
- The requests load metric uses the number of client requests to determine which cluster node receives the next work load. For instance, capacity 1000 means that 1000 requests/sec is considered to be a "full load".
- send-traffic
- The send-traffic load metric uses the amount of traffic sent from the worker node to the clients. E.g. the default capacity of 512 indicates that the node should be considered under full load if the average outbound traffic is 512 KB/s or higher.
- receive-traffic
- The receive-traffic load metric uses the amount of traffic sent to the worker node from the clients.E.g. the default capacity of 1024 indicates that the node should be considered under full load if the average inbound traffic is 1024 KB/s or higher.
- busyness
- This metric represents the amount of threads from the thread pool being busy serving requests.
Example 16.1. Set a Load Balancer Metric
/profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/dynamic-load-provider=configuration/load-metric=cpu/:write-attribute(name="weight",value="3")
16.5.3. Install the mod_cluster Module Into Apache HTTPD or JBoss Enterprise Web Server HTTPD
Prerequisites
- To perform this task, you must be using Apache HTTPD installed in Red Hat Enterprise Linux 6, or JBoss Enterprise Web Server, or the stand-alone HTTPD included as a separate downloadable component of JBoss EAP 6.
- If you need to install Apache HTTPD in Red Hat Enterprise Linux 6, use the instructions from the Red Hat Enterprise Linux 6 Deployment Guide, available from https://access.redhat.com/site/documentation/.
- If you need to install the stand-alone HTTPD included as a separate downloadable component of JBoss EAP 6, refer to Section 16.3.2, “Install the Apache HTTPD included with JBoss EAP 6”.
- If you need to install JBoss Enterprise Web Server, use the instructions from the JBoss Enterprise Web Server Installation Guide, available from https://access.redhat.com/site/documentation/.
- Download the Webserver Connecter Natives package for your operating system and architecture from the Red Hat Customer Portal at https://access.redhat.com. This package contains the mod_cluster binary HTTPD modules precompiled for your operating system. After you extract the archive, the modules are located in the
modules/native/lib/httpd/modules/
directory.Theetc/
directory contains some example configuration files, and theshare/
directory contains some supplemental documentation. - You must be logged in with administrative (root) privileges.
Procedure 16.5. Install the mod_cluster Module
Determine your HTTPD configuration location.
Your HTTPD configuration location will be different depending on whether you are using Red Hat Enterprise Linux's Apache HTTPD, the stand-alone HTTPD included as a separate downloadable component with JBoss EAP 6, or the HTTPD available in JBoss Enterprise Web Server. It is one of the following three options, and is referred to in the rest of this task as HTTPD_HOME.- Apache HTTPD -
/etc/httpd/
- JBoss EAP 6 HTTPD - This location is chosen by you, based on the requirements of your infrastructure.
- JBoss Enterprise Web Server HTTPD -
EWS_HOME/httpd/
Copy the modules to the HTTPD modules directory.
Copy the four modules (the files ending in.so
) from themodules/native/lib/httpd/modules/
directory of the extracted Webserver Natives archive to theHTTPD_HOME/modules/
directory.For JBoss Enterprise Web Server, disable the
mod_proxy_balancer
module.If you use JBoss Enterprise Web Server, themod_proxy_balancer
module is enabled by default. It is incompatible with mod_cluster. To disable it, edit theHTTPD_HOME/conf/httpd.conf
and comment out the following line by placing a#
(hash) symbol before the line which loads the module. The line is shown without the comment and then with it, below.LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
# LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
Save and close the file.Configure the mod_cluster module.
The Webserver Natives archive contains a samplemod_cluster.conf
file (modules/system/layers/base/native/etc/httpd/conf
). This file can be used as a guide or copied and edited to create aHTTPD_HOME/httpd/conf.d/JBoss_HTTP.conf
file.Note
Using the nameJBoss_HTTP.conf
is an arbitrary convention in this document. The configuration file will be loaded, regardless of its name, if it is saved in theconf.d/
directory with the.conf
extension.Add the following to your configuration file:LoadModule slotmem_module modules/mod_slotmem.so LoadModule manager_module modules/mod_manager.so LoadModule proxy_cluster_module modules/mod_proxy_cluster.so LoadModule advertise_module modules/mod_advertise.so
This causes Apache HTTPD to automatically load the modules thatmod_cluster
needs in order to function.Create a proxy server listener.
Continue editingHTTPD_HOME/httpd/conf.d/JBoss_HTTP.conf
and add the following minimal configuration, replacing the values in capital letters with sensible ones for your system.Listen IP_ADDRESS:PORT <VirtualHost IP_ADDRESS:PORT> <Location /> Order deny,allow Deny from all Allow from *.MYDOMAIN.COM </Location> KeepAliveTimeout 60 MaxKeepAliveRequests 0 EnableMCPMReceive On ManagerBalancerName mycluster ServerAdvertise On </VirtualHost>
These directives create a new virtual server which listens onIP_ADDRESS:PORT
, allows connections fromMYDOMAIN.COM
, and advertises itself as a balancer calledmycluster
. These directives are covered in detail in the documentation for Apache Web Server. To learn more about theServerAdvertise
andEnableMCPMReceive
directives, and the implications of server advertisement, refer to Section 16.5.4, “Configure Server Advertisement Properties for Your mod_cluster-enabled HTTPD”.Save the file and exit.Restart the HTTPD.
The way to restart the HTTPD depends on whether you are using Red Hat Enterprise Linux's Apache HTTPD or the HTTPD included in JBoss Enterprise Web Server. Choose one of the two methods below.Red Hat Enterprise Linux 6 Apache HTTPD
Issue the following command:[root@host]#
service httpd restart
JBoss Enterprise Web Server HTTPD
JBoss Enterprise Web Server runs on both Red Hat Enterprise Linux and Microsoft Windows Server. The method for restarting the HTTPD is different for each.Red Hat Enterprise Linux
In Red Hat Enterprise Linux, JBoss Enterprise Web Server installs its HTTPD as a service. To restart the HTTPD, issue the following two commands:[root@host ~]# service httpd stop
[root@host ~]# service httpd start
Microsoft Windows Server
Issue the following commands in a command prompt with administrative privileges:C:\> net stop httpd
C:\> net start httpd
The Apache HTTPD is now configured as a load balancer, and can work with the mod_cluster
subsystem running JBoss EAP 6. To configure JBoss EAP 6 to be aware of mod_cluster, refer to Section 16.5.5, “Configure a mod_cluster Worker Node”.
16.5.4. Configure Server Advertisement Properties for Your mod_cluster-enabled HTTPD
For instructions on configuring your HTTPD to interact with the mod_cluster load balancer, refer to Section 16.5.3, “Install the mod_cluster Module Into Apache HTTPD or JBoss Enterprise Web Server HTTPD”. One aspect of the configuration which needs more explanation is server advertisement.
httpd.conf
associated with your Apache HTTPD instance. This is often /etc/httpd/conf/httpd.conf
in Red Hat Enterprise Linux, or may be in the etc/
directory of your stand-alone Apache HTTPD instance.
Procedure 16.6. Edit the httpd.conf file and implement the changes
Disable the
AdvertiseFrequency
parameter, if it exists.If you have a line like the following in your<VirtualHost>
statement, comment it out by putting a#
(hash) character before the first character. The value may be different from5
.AdvertiseFrequency 5
Add the directive to disable server advertisement.
Add the following directive inside the<VirtualHost>
statement, to disable server advertisement.ServerAdvertise Off
Enable the ability to receive MCPM messages.
Add the following directive to allow the HTTPD server to receive MCPM messages from the worker nodes.EnableMCPMReceive On
Restart the HTTPD server.
Restart the HTTPD server by issuing one of the following, depending on whether you use Red Hat Enterprise Linux or Microsoft Windows Server.Red Hat Enterprise Linux
[root@host ]# service httpd restart
Microsoft Windows Server
C:\> net service http C:\> net service httpd start
The HTTPD no longer advertises the IP address and port of your mod_cluster proxy. To reiterate, you need to configure your worker nodes to use a static address and port to communicate with the proxy. Refer to Section 16.5.5, “Configure a mod_cluster Worker Node” for more details.
16.5.5. Configure a mod_cluster Worker Node
A mod_cluster worker node consists of a JBoss EAP server. This server can be part of a server group in a Managed Domain, or a standalone server. A separate process runs within JBoss EAP, which manages all of the nodes of the cluster. This is called the master. For more conceptual information about worker nodes, refer to Section 16.1.4, “Worker Node”. For an overview of HTTPD load balancing, refer to Section 16.1.3, “Overview of HTTP Connectors”.
mod_cluster
subsystem. To configure the mod_cluster
subsystem, refer to Configure the mod_cluster Subsystem in the Administration and Configuration Guide. Each worker node is configured separately, so repeat this procedure for each node you wish to add to the cluster.
Worker Node Configuration
- If you use a standalone server, it must be started with the
standalone-ha
profile. - If you use a managed domain, your server group must use the
ha
orfull-ha
profile, and theha-sockets
orfull-ha-sockets
socket binding group. JBoss EAP 6 ships with a cluster-enabled server group calledother-server-group
which meets these requirements.
Note
/profile=full-ha
portion of the commands.
Procedure 16.7. Configure a Worker Node
Configure the network interfaces.
By default, the network interfaces all default to127.0.0.1
. Every physical host which hosts either a standalone server or one or more servers in a server group needs its interfaces to be configured to use its public IP address, which the other servers can see.To change the IP address of a JBoss EAP 6 host, you need to shut it down and edit its configuration file directly. This is because the Management API which drives the Management Console and Management CLI relies on a stable management address.Follow these steps to change the IP address on each server in your cluster to the master's public IP address.- Shut down the server completely.
- Edit either the
host.xml
, which is inEAP_HOME/domain/configuration/
for a managed domain, or thestandalone-ha.xml
file, which is inEAP_HOME/standalone/configuration/
for a standalone server. - Locate the
<interfaces>
element. Three interfaces are configured,management
,public
, andunsecured
. For each of these, change the value127.0.0.1
to the external IP address of the host. - For hosts that participate in a managed domain but are not the master, locate the
<host
element. Note that it does not have the closing>
symbol, because it contains attributes. Change the value of its name attribute frommaster
to a unique name, a different one per slave. This name will also be used for the slave to identify to the cluster, so make a note of it. - For newly-configured hosts which need to join a managed domain, find the
<domain-controller>
element. Comment out or remove the<local />
element, and add the following line, changing the IP address (X.X.X.X
) to the address of the domain controller. This step does not apply for a standalone server.<remote host="X.X.X.X" port="${jboss.domain.master.port:9999}" security-realm="ManagementRealm"/>
- Save the file and exit.
Configure authentication for each slave server.
Each slave server needs a username and password created in the domain controller's or standalone master'sManagementRealm
. On the domain controller or standalone master, run theEAP_HOME/add-user.sh
command. Add a user with the same username as the slave, to theManagementRealm
. When asked if this user will need to authenticate to an external JBoss AS instance, answeryes
. An example of the input and output of the command is below, for a slave calledslave1
, with passwordchangeme
.user:bin user$ ./add-user.sh What type of user do you wish to add? a) Management User (mgmt-users.properties) b) Application User (application-users.properties) (a):
a
Enter the details of the new user to add. Realm (ManagementRealm) : Username :slave1
Password :changeme
Re-enter Password :changeme
About to add user 'slave1' for realm 'ManagementRealm' Is this correct yes/no?yes
Added user 'slave1' to file '/home/user/jboss-eap-6.0/standalone/configuration/mgmt-users.properties' Added user 'slave1' to file '/home/user/jboss-eap-6.0/domain/configuration/mgmt-users.properties' Is this new user going to be used for one AS process to connect to another AS process e.g. slave domain controller? yes/no? yes To represent the user add the following to the server-identities definition <secret value="Y2hhbmdlbWU=" />Copy the Base64-encoded
<secret>
element from theadd-user.sh
output.If you plan to specify the Base64-encoded password value for authentication, copy the<secret>
element value from the last line of theadd-user.sh
output as you will need it in the step below.Modify the slave host's security realm to use the new authentication.
- Re-open the slave host's
host.xml
orstandalone-ha.xml
file. - Locate the
<security-realms>
element. This is where you configure the security realm. - You can specify the secret value in one of the following ways:
Specify the Base64-encoded password value in the configuration file.
- Add the following block of XML code directly below the
<security-realm name="ManagementRealm">
line,<server-identities> <secret value="Y2hhbmdlbWU="/> </server-identities>
- Replace the "Y2hhbmdlbWU=" with the secret value returned from the
add-user.sh
output in the previous step.
Configure the host to get the password from the vault.
- Use the
vault.sh
script to generate a masked password. It will generate a string like the following:VAULT::secret::password::ODVmYmJjNGMtZDU2ZC00YmNlLWE4ODMtZjQ1NWNmNDU4ZDc1TElORV9CUkVBS3ZhdWx0
.You can find more information on the vault in the Password Vaults for Sensitive Strings section of this guide starting here: Section 10.12.1, “About Securing Sensitive Strings in Clear-Text Files”. - Add the following block of XML code directly below the
<security-realm name="ManagementRealm">
line.<server-identities> <secret value="${VAULT::secret::password::ODVmYmJjNGMtZDU2ZC00YmNlLWE4ODMtZjQ1NWNmNDU4ZDc1TElORV9CUkVBS3ZhdWx0}"/> </server-identities>
Be sure to replace the secret value with the masked password generated in the previous step.Note
When creating a password in the vault, it must be specified in plain text, not Base64-encoded.
Specify the password as a system property.
- Add the following block of XML code directly below the
<security-realm name="ManagementRealm">
line<server-identities> <secret value=${server.identity.password}/> </server-identities>
- When you specify the password as a system property, you can configure the host in either of the following ways:
- Start the server entering the password in plain text as a command line argument, for example:
-Dserver.identity.password=changeme
Note
The password must be entered in plain text and will be visible to anyone who issues aps -ef
command. - Place the password in a properties file and pass the properties file URL as a command line argument.
- Add the key/value pair to a properties file. For example:
server.identity.password=changeme
- Start the server with the command line arguments
--properties=URL_TO_PROPERTIES_FILE
.
- Save and exit the file.
Restart the server.
The slave will now authenticate to the master using its host name as the username and the encrypted string as its password.
Your standalone server, or servers within a server group of a managed domain, are now configured as mod_cluster worker nodes. If you deploy a clustered application, its sessions are replicated to all cluster nodes for failover, and it can accept requests from an external HTTPD server or load balancer. Each node of the cluster discovers the other nodes using automatic discovery, by default.To configure automatic discovery, and the other specific settings of the mod_cluster
subsystem, refer to Section 16.5.2, “Configure the mod_cluster
Subsystem”. To configure the Apache HTTPD server, refer to Section 16.3.4, “Use an External HTTPD as the Web Front-end for JBoss EAP 6 Applications”.
16.5.6. Migrate Traffic between Clusters
After creating a new cluster using JBoss EAP 6, you may want to migrate traffic from a previous cluster to the new one as part of an upgrade process. In this task, you will see the strategy that can be used to migrate this traffic with minimal outage or downtime.
Prerequisites
- A new cluster setup: Section 16.5.2, “Configure the
mod_cluster
Subsystem” (We will call this cluster: Cluster NEW). - An old cluster setup that is being made redundant (We will call this cluster: Cluster OLD).
Procedure 16.8. Upgrade Process for Clusters
- Setup your new cluster using the steps described in the prerequisites.
- In both Cluster NEW and Cluster OLD, make sure that the configuration option
sticky-session
is set totrue
(this istrue
by default). Enabling this option means that all new requests made to a cluster node in either cluster will continue to go to that node./profile=full-ha/subsystem=modcluster/mod-cluster-config=configuration/:write-attribute(name=sticky-session,value=true)
- Add the nodes in Cluster NEW to the mod_cluster configuration individually using the process described here: Section 16.5.5, “Configure a mod_cluster Worker Node”
- Configure the load balancer (mod_cluster) to stop the individual contexts in Cluster OLD. Stopping contexts (as opposed to disabling them) in Cluster OLD will allow the individual contexts to shutdown gracefully (and eventually shutdown the whole node). Existing sessions will still be served, but no new sessions will be directed to those nodes. The stopped contexts may take several minutes to several hours to stop.You can use the following CLI command to stop a context. Replace the parameter values with values that are relevant in your environment.
[standalone@localhost:9999 subsystem=modcluster] :stop-context(context=/myapp, virtualhost=default-host, waittime=50)
You have successfully upgraded a JBoss EAP 6 Cluster.
16.6. Apache mod_jk
16.6.1. About the Apache mod_jk HTTP Connector
mod_jk
is a HTTP connector which is provided for customers who need it for compatibility purposes. Apache mod_jk
provides load balancing, and is a part of the jboss-eap-native-webserver-connectors that is contained in JBoss Web Container. For supported platforms, see https://access.redhat.com/site/articles/111663. The mod_jk
connector is maintained by Apache, and its documentation is located at http://tomcat.apache.org/connectors-doc/.
mod_cluster
HTTP connector, an Apache proxy server does not know the status of deployments on servers or server groups, and cannot adapt where it sends its work accordingly.
mod_cluster
, mod_jk
communicates over the AJP 1.3 protocol.
Note
mod_cluster
is a more advanced load balancer than mod_jk
. mod_cluster
provides all of the functionality of mod_jk
plus many additional features. For more information about mod_cluster
, see Section 16.5.1, “About the mod_cluster
HTTP Connector”.
Next step: Configure the JBoss EAP 6 to participate in a mod_jk load balancing group
16.6.2. Configure JBoss EAP 6 to Communicate with Apache Mod_jk
The mod_jk HTTP connector has a single component, the mod_jk.so
module loaded by the HTTPD. This module receives client requests and forwards them to the container, in this case JBoss EAP 6. JBoss EAP 6 also needs to be configured to accept these requests and send replies back to the HTTPD.
- In a managed domain, in server groups using the
ha
andfull-ha
profiles, and theha
orfull-ha
socket binding group. Theother-server-group
server group is configured correctly in a default installation. - In a standalone server, the
standalone-ha
andstandalone-full-ha
profiles are configured for clustered configurations. To start the standalone server with one of these profiles, issue the following command, from theEAP_HOME/
directory. Substitute the appropriate profile name.[user@host bin]$
./bin/standalone.sh --server-config=standalone-ha.xml
16.6.3. Install the Mod_jk Module Into Apache HTTPD or JBoss Enterprise Web Server HTTPD
Prerequisites
- To perform this task, you must be using Apache HTTPD installed on a supported environment or the HTTPD installed in JBoss Enterprise Web Server. Note that the HTTPD installed in JBoss Enterprise Web Server is part of the JBoss EAP 6 distribution.
- If you need to install Apache HTTPD, use the instructions from the Red Hat Enterprise Linux Deployment Guide, available from https://access.redhat.com/site/documentation/.
- If you need to install JBoss Enterprise Web Server, use the instructions from the JBoss Enterprise Web Server Installation Guide, available from https://access.redhat.com/site/documentation/.
- If you are using Apache HTTPD, download the JBoss EAP 6 Native Components package for your platform from the Red Hat Customer Service Portal at https://access.redhat.com. This package contains both the mod_jk and mod_cluster binaries precompiled for Red Hat Enterprise Linux. If you are using JBoss Enterprise Web Server, it already includes the binary for mod_jk.
- You must be logged in with administrative (root) privileges.
Procedure 16.9. Install the mod_jk Module
Determine your HTTPD configuration location.
Your HTTPD configuration location will be different depending on whether you are using Red Hat Enterprise Linux's Apache HTTPD or the HTTPD available in JBoss Enterprise Web Server. It is one of the following options, and is referred to in the rest of this task as HTTPD_HOME.- Apache HTTPD -
/etc/httpd/
- JBoss Enterprise Web Server HTTPD on RHEL -
EWS_HOME/httpd
- JBoss Enterprise Web Server HTTPD on Solaris -
EWS_HOME/etc/httpd
- JBoss Enterprise Web Server HTTPD on Windows -
EWS_HOME/etc/httpd
Configure the mod_jk module.
- Create a new file called
HTTPD_HOME/conf.d/mod-jk.conf
and add the following to it:Note
TheJkMount
directive specifies which URLs Apache should forward to the mod_jk module. Based on the directive's configuration, mod_jk forwards the received URL to the correct Servlet containers.To serve static content directly, and only use the load balancer for Java applications, the URL path should be/application/*
. To use mod_jk as a load balancer, use the value/*
, to forward all URLs to mod_jk.# Load mod_jk module # Specify the filename of the mod_jk lib LoadModule jk_module modules/mod_jk.so # Where to find workers.properties JkWorkersFile conf/workers.properties # Where to put jk logs JkLogFile logs/mod_jk.log # Set the jk log level [debug/error/info] JkLogLevel info # Select the log format JkLogStampFormat "[%a %b %d %H:%M:%S %Y]" # JkOptions indicates to send SSK KEY SIZE JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories # JkRequestLogFormat JkRequestLogFormat "%w %V %T" # Mount your applications # The default setting only sends Java application data to mod_jk. # Use the commented-out line to send all URLs through mod_jk. # JkMount /* loadbalancer JkMount /application/* loadbalancer # Add shared memory. # This directive is present with 1.2.10 and # later versions of mod_jk, and is needed for # for load balancing to work properly JkShmFile logs/jk.shm # Add jkstatus for managing runtime data <Location /jkstatus/> JkMount status Order deny,allow Deny from all Allow from 127.0.0.1 </Location>
Look over the values and make sure they are reasonable for your set-up. When you are satisfied, save the file. Specify a JKMountFile directive
In addition to the JKMount directive in themod-jk.conf
, you can specify a file which contains multiple URL patterns to be forwarded to mod_jk.- Add the following to the
HTTPD_HOME/conf/mod-jk.conf
file:# You can use external file for mount points. # It will be checked for updates each 60 seconds. # The format of the file is: /url=worker # /examples/*=loadbalancer JkMountFile conf/uriworkermap.properties
- Create a new file called
HTTPD_HOME/conf/uriworkermap.properties
, with a line for each URL pattern to be matched. The following example shows examples of the syntax of the file.# Simple worker configuration file /*=loadbalancer
Copy the mod_jk.so file to the HTTPD's modules directory
Note
This is only necessary if your HTTPD does not havemod_jk.so
in itsmodules/
directory. You can skip this step if you are using the Apache HTTPD server included as a download as part of JBoss EAP 6.Extract the Native Web Server Connectors ZIP package. Locate themod_jk.so
file in either theEAP_HOME/modules/native/lib/httpd/modules/
or theEAP_HOME/modules/native/lib64/httpd/modules/
directories, depending on whether your operating system is 32-bit or 64-bit.Copy the file to theHTTPD_HOME/modules/
directory.
Configure the mod_jk worker nodes.
- Create a new file called
HTTPD_HOME/conf/workers.properties
. Use the following example as your starting point, and modify the file to suit your needs.# Define list of workers that will be used # for mapping requests worker.list=loadbalancer,status # Define Node1 # modify the host as your host IP or DNS name. worker.node1.port=8009 worker.node1.host=node1.mydomain.com worker.node1.type=ajp13 worker.node1.ping_mode=A worker.node1.lbfactor=1 # Define Node2 # modify the host as your host IP or DNS name. worker.node2.port=8009 worker.node2.host=node2.mydomain.com worker.node2.type=ajp13 worker.node2.ping_mode=A worker.node2.lbfactor=1 # Load-balancing behavior worker.loadbalancer.type=lb worker.loadbalancer.balance_workers=node1,node2 worker.loadbalancer.sticky_session=1 # Status worker for managing load balancer worker.status.type=status
For a detailed description of the syntax of theworkers.properties
file, and advanced configuration options, refer to Section 16.6.4, “Configuration Reference for Apache Mod_jk Workers”.
Restart the HTTPD.
The way to restart the HTTPD depends on whether you are using Red Hat Enterprise Linux's Apache HTTPD or the HTTPD included in JBoss Enterprise Web Server. Choose one of the two methods below.Red Hat Enterprise Linux's Apache HTTPD
Issue the following command:[root@host]#
service httpd restart
JBoss Enterprise Web Server HTTPD
JBoss Enterprise Web Server runs on both Red Hat Enterprise Linux and Microsoft Windows Server. The method for restarting the HTTPD is different for each.Red Hat Enterprise Linux, installed from RPM
In Red Hat Enterprise Linux, JBoss Enterprise Web Server installs its HTTPD as a service. To restart the HTTPD, issue the following two commands:[root@host ~]# service httpd stop [root@host ~]# service httpd start
Red Hat Enterprise Linux, installed from ZIP
If you have installed the JBoss Enterprise Web Server HTTPD from a ZIP archive, use theapachectl
command to restart the HTTPD. Replace EWS_HOME with the directory where you unzipped JBoss Enterprise Web Server HTTPD.[root@host ~]# EWS_HOME/httpd/sbin/apachectl restart
Microsoft Windows Server
Issue the following commands in a command prompt with administrative privileges:C:\> net stop Apache2.2 C:\> net start Apache2.2
Solaris
Issue the following commands in a command prompt with administrative privileges. Replace EWS_HOME with the directory where you unzipped JBoss Enterprise Web Server HTTPD.[root@host ~] EWS_HOME/httpd/sbin/apachectl restart
The Apache HTTPD is now configured to use the mod_jk load balancer. To configure JBoss EAP 6 to be aware of mod_jk, refer to Section 16.3.5, “Configure JBoss EAP 6 to Accept Requests From an External HTTPD”.
16.6.4. Configuration Reference for Apache Mod_jk Workers
workers.properties
file defines the behavior of the worker nodes which mod_jk passes client requests to. In Red Hat Enterprise Linux, the file resides in /etc/httpd/conf/workers.properties
. The workers.properties
file defines where the different servlet containers are located, and the way the work load should be balanced across them.
worker.WORKER_NAME.DIRECTIVE
, where WORKER_NAME is a unique name for the worker, and DIRECTIVE is the setting to be applied to the worker.
Node templates specify default per-node settings. You can override the template within the node settings itself. You can see an example of node templates in Example 16.2, “Example workers.properties
file”.
Table 16.11. Global properties
Property | Description |
---|---|
worker.list | The list of worker names used by mod_jk. These workers are available to receive requests. |
Table 16.12. Per-worker properties
Property | Description |
---|---|
type |
The type of the worker. The default type is
ajp13 . Other possible values are ajp14 , lb , status .
For more information on these directives, refer to the Apache Tomcat Connector AJP Protocol Reference at http://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html.
|
balance_workers |
Specifies the worker nodes that the load balancer must manage. You can use the directive multiple times for the same load balancer. It consists of a comma-separated list of worker names. This is set per worker, not per node. It affects all nodes balanced by that worker type.
|
sticky_session |
Specifies whether requests from the same session are always routed to the same worker. The default is
0 , meaning that sticky sessions are disabled. To enable sticky sessions, set it to 1 . Sticky sessions should usually be enabled, unless all of your requests are truly stateless. This is set per worker, not per node. It affects all nodes balanced by that worker type.
|
Table 16.13. Per-node properties
Property | Description |
---|---|
host |
The hostname or IP address of the worker. The worker node must support the
ajp protocol stack. The default value is localhost .
|
port |
The port number of the remote server instance listening for defined protocol requests. The default value is
8009 , which is the default listening port for AJP13 workers. The default value for AJP14 workers is 8011.
|
ping_mode |
The conditions under which connections are probed for network status. The probe uses an empty AJP13 packet for CPing, and expects a CPong in response. Specify the conditions by using a combination of directive flags. The flags are not separated by a comma or any white-space. The ping_mode can be any combination of
C , P , I , and A .
|
ping_timeout, connect_timeout, prepost_timeout, connection_ping_interval |
The timeout values for the connection probe settings above. The value is specified in milliseconds, and the default value for
ping_timeout is 10000.
|
lbfactor |
Specifies the load-balancing factor for an individual worker, and only applies to a member worker of a load balancer. This is useful to give a more powerful server more of the work load. To give a worker 3 times the default load, set this to
3 : worker.my_worker.lbfactor=3
|
Example 16.2. Example workers.properties
file
worker.list=node1, node2, node3 worker.balancer1.sticky_sessions=1 worker.balancer1.balance_workers=node1 worker.balancer2.sticky_session=1 worker.balancer2.balance_workers=node2,node3 worker.nodetemplate.type=ajp13 worker.nodetemplate.port=8009 worker.node1.template=nodetemplate worker.node1.host=localhost worker.node1.ping_mode=CI worker.node1.connection_ping_interval=9000 worker.node1.lbfactor=1 worker.node2.template=nodetemplate worker.node2.host=192.168.1.1 worker.node2.ping_mode=A worker.node3.template=nodetemplate worker.node3.host=192.168.1.2
16.7. Apache mod_proxy
16.7.1. About the Apache mod_proxy HTTP Connector
mod_proxy
and mod_jk
. To learn more about mod_jk
, refer to Section 16.6.1, “About the Apache mod_jk HTTP Connector”. JBoss EAP 6 supports use of either of these, although mod_cluster
, the JBoss HTTP connector, more closely couples JBoss EAP 6 and the external HTTPD, and is the recommended HTTP connector. Refer to Section 16.1.3, “Overview of HTTP Connectors” for an overview of all supported HTTP connectors, including advantages and disadvantages.
mod_jk
, mod_proxy
supports connections over HTTP and HTTPS protocols. Each of them also support the AJP protocol.
mod_proxy
can be configured in standalone or load-balanced configurations, and it supports the notion of sticky sessions.
mod_proxy
module requires JBoss EAP 6 to have the HTTP, HTTPS or AJP web connector configured. This is part of the Web subsystem. Refer to Section 15.1, “Configure the Web Subsystem” for information on configuring the Web subsystem.
16.7.2. Install the Mod_proxy HTTP Connector Into Apache HTTPD
mod_proxy
is a load-balancing module provided by Apache. This task presents a basic configuration. For more advanced configuration, or additional details, refer to Apache's mod_proxy
documentation at https://httpd.apache.org/docs/2.2/mod/mod_proxy.html. For more details about mod_proxy
from the perspective of JBoss EAP 6, refer to Section 16.7.1, “About the Apache mod_proxy HTTP Connector” and Section 16.1.3, “Overview of HTTP Connectors”.
Prerequisites
- Either JBoss Enterprise Web Server HTTPD or Apache HTTPD needs to be installed. A standalone HTTPD is provided as a separate download in the Red Hat Customer Portal at https://access.redhat.com, in the JBoss EAP 6 download area. Refer to Section 16.3.2, “Install the Apache HTTPD included with JBoss EAP 6” for information about this HTTPD if you wish to use it.
- The
mod_proxy
modules need to be installed. Apache HTTPD typically comes with themod_proxy
modules already included. This is the case on Red Hat Enterprise Linux and the HTTPD that comes with the JBoss Enterprise Web Server. - You need
root
or administrator privileges to modify the HTTPD configuration. - Determine the HTTPD configuration directory. This is the directory containing the
conf/
andmodules/
directories for Apache HTTPD. This will be referred to asHTTPD_HOME
for the remainder of this task. Typical values include the following:/etc/httpd/
EWS_HOME/httpd/
, starting from where JBoss Enterprise Web Server is installed
- In our example we assume that JBoss EAP 6 is configured with the HTTP or HTTPS web connector. This is part of the Web subsystem configuration. Refer to Section 15.1, “Configure the Web Subsystem” for information about configuring the Web subsystem.
Enable the
mod_proxy
modules in the HTTPDLook for the following lines in yourHTTPD_HOME/conf/httpd.conf
file. If they are not present, add them to the bottom. If they are present but the lines begin with a comment (#) character, remove the character. Save the file afterward. Usually, the modules are already present and enabled.LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule proxy_http_module modules/mod_proxy_http.so # Uncomment these to proxy FTP or HTTPS #LoadModule proxy_ftp_module modules/mod_proxy_ftp.so #LoadModule proxy_connect_module modules/mod_proxy_connect.so
Add a non-load-balancing proxy.
Add the following configuration to yourHTTPD_HOME/conf/httpd.conf
file, directly beneath any other<VirtualHost>
directives you may have. Replace the values with ones appropriate to your set-up.This example uses a virtual host. See the next step to use the default HTTPD configuration.<VirtualHost *:80> # Your domain name ServerName Domain_NAME_HERE ProxyPreserveHost On # The IP and port of JBoss EAP 6 # These represent the default values, if your HTTPD is on the same host # as your JBoss EAP 6 managed domain or server ProxyPass / http://localhost:8080/ ProxyPassReverse / http://localhost:8080/ # The location of the HTML files, and access control information DocumentRoot /var/www <Directory /var/www> Options -Indexes Order allow,deny Allow from all </Directory> </VirtualHost>
After making your changes, save the file.Add a load-balancing proxy.
To usemod_proxy
as a load balancer, and send work to multiple JBoss EAP 6 servers, add the following configuration to yourHTTPD_HOME/conf/httpd.conf
file. The example IP addresses are fictional. Replace them with the appropriate values for your environment.<Proxy balancer://mycluster> Order deny,allow Allow from all # Add each JBoss Enterprise Application Server by IP address and port. # If the route values are unique like this, one node will not fail over to the other. BalancerMember http://192.168.1.1:8080 route=node1 BalancerMember http://192.168.1.2:8180 route=node2 </Proxy> <VirtualHost *:80> # Your domain name ServerName YOUR_DOMAIN_NAME ProxyPreserveHost On ProxyPass / balancer://mycluster/ # The location of the HTML files, and access control information DocumentRoot /var/www <Directory /var/www> Options -Indexes Order allow,deny Allow from all </Directory> </VirtualHost>
The examples above all communicate using the HTTP protocol. You can use AJP or HTTPS protocols instead, if you load the appropriatemod_proxy
modules. Refer to Apache'smod_proxy
documentation http://httpd.apache.org/docs/2.2/mod/mod_proxy.html for more details.Enable sticky sessions.
Sticky sessions mean that if a client request originally goes to a specific JBoss EAP 6 node, all future requests will be sent to the same node, unless the node becomes unavailable. This is almost always the correct behavior.To enable sticky sessions formod_proxy
, add thestickysession
parameter to theProxyPass
statement. This example also shows some other parameters which you can use. Refer to Apache'smod_proxy
documentation at http://httpd.apache.org/docs/2.2/mod/mod_proxy.html for more information on them.ProxyPass /MyApp balancer://mycluster stickysession=JSESSIONID lbmethod=bytraffic nofailover=Off
Restart the HTTPD.
Restart the HTTPD server for your changes to take effect.
Your HTTPD is configured to use mod_proxy
to send client requests to JBoss EAP 6 servers or clusters, either in a standard or load-balancing configuration. To configure JBoss EAP 6 to respond to these requests, refer to Section 16.3.5, “Configure JBoss EAP 6 to Accept Requests From an External HTTPD”.
16.8. Microsoft ISAPI
16.8.1. About the Internet Server API (ISAPI) HTTP Connector
16.8.2. Configure Microsoft IIS to Use the ISAPI Redirector
Prerequisites
- Make sure you are using a supported operating system and install the IIS server. Refer to https://access.redhat.com/site/articles/111663 for the list of supported configurations.
- Download the JBoss Native Components package for Microsoft Windows, from the Customer Support Portal at https://access.redhat.com. Navigate to Downloads, then JBoss Enterprise Middleware, then Application Platform. Choose either
i386
orx86_64
. Unzip the file, which includes the ISAPI redirect DLL in thejboss-eap-6.0/modules/native/sbin/
directory.Extract the Native Components zip file and copy the contents of thesbin\
directory to a location on your server. The rest of this task assumes that you usedC:\connectors\
.
Procedure 16.10. Configure the IIS Redirector Using the IIS Manager (IIS 7)
- Open the IIS manager by clicking Start → Run , and typing
inetmgr
. - In the tree view pane at the left, expand IIS 7.
- Double-click ISAPI and CGI Registrations to open it in a new window.
- In the Actions pane, click Add. The Add ISAPI or CGI Restriction window opens.
- Specify the following values:
- ISAPI or CGI Path:
c:\connectors\isapi_redirect.dll
- Description:
jboss
- Allow extension path to execute: select the check box.
- Click OK to close the Add ISAPI or CGI Restriction window.
Define a JBoss Native virtual directory
- Right-click Default Web Site, and click Add Virtual Directory. The Add Virtual Directory window opens.
- Specify the following values to add a virtual directory:
- Alias:
jboss
- Physical Path:
C:\connectors\
- Click OK to save the values and close the Add Virtual Directory window.
Define a JBoss Native ISAPI Redirect Filter
- In the tree view pane, expand Sites → Default Web Site.
- Double-click ISAPI Filters. The ISAPI Filters Features view appears.
- In the Actions pane, click Add. The Add ISAPI Filter window appears.
- Specify the following values in the Add ISAPI Filter window:
- Filter name:
jboss
- Executable:
C:\connectors\isapi_redirect.dll
- Click OK to save the values and close the Add ISAPI Filters window.
Enable the ISAPI-dll handler
- Double-click the IIS 7 item in the tree view pane. The IIS 7 Home Features View opens.
- Double-click Handler Mappings. The Handler Mappings Features View appears.
- In the Group by combo box, select State. The Handler Mappings are displayed in Enabled and Disabled Groups.
- Find ISAPI-dll. If it is in the Disabled group, right-click it and select Edit Feature Permissions.
- Enable the following permissions:
- Read
- Script
- Execute
- Click OK to save the values, and close the Edit Feature Permissions window.
Microsoft IIS is now configured to use the ISAPI Redirector. Next, Section 16.3.5, “Configure JBoss EAP 6 to Accept Requests From an External HTTPD”, then Section 16.8.3, “Configure the ISAPI Redirector to Send Client Requests to JBoss EAP 6” or Section 16.8.4, “Configure ISAPI to Balance Client Requests Across Multiple JBoss EAP 6 Servers”.
16.8.3. Configure the ISAPI Redirector to Send Client Requests to JBoss EAP 6
This task configures a group of JBoss EAP 6 servers to accept requests from the ISAPI redirector. It does not include configuration for load-balancing or high-availability failover. If you need these capabilities, refer to Section 16.8.4, “Configure ISAPI to Balance Client Requests Across Multiple JBoss EAP 6 Servers”.
Prerequisites
- You need full administrator access to the IIS server
Procedure 16.11. Edit Property Files and Setup Redirection
Create a directory to store logs, property files, and lock files.
The rest of this procedure assumes that you are using the directoryC:\connectors\
for this purpose. If you use a different directory, modify the instructions accordingly.Create the
isapi_redirect.properties
file.Create a new file calledC:\connectors\isapi_redirect.properties
. Copy the following contents into the file.# Configuration file for the ISAPI Redirector # Extension uri definition extension_uri=c:\connectors\isapi_redirect.dll # Full path to the log file for the ISAPI Redirector log_file=c:\connectors\isapi_redirect.log # Log level (debug, info, warn, error or trace) # Use debug only testing phase, for production switch to info log_level=debug # Full path to the workers.properties file worker_file=c:\connectors\workers.properties # Full path to the uriworkermap.properties file worker_mount_file=c:\connectors\uriworkermap.properties #Full path to the rewrite.properties file rewrite_rule_file=c:\connectors\rewrite.properties
If you do not want to use arewrite.properties
file, comment out the last line by placing a#
character at the beginning of the line. See Step 5 for more information.Create the
uriworkermap.properties
fileTheuriworkermap.properties
file contains mappings between deployed application URLs and which worker handles requests to them. The following example file shows the syntax of the file. Place youruriworkermap.properties
file intoC:\connectors\
.# images and css files for path /status are provided by worker01 /status=worker01 /images/*=worker01 /css/*=worker01 # Path /web-console is provided by worker02 # IIS (customized) error page is used for http errors with number greater or equal to 400 # css files are provided by worker01 /web-console/*=worker02;use_server_errors=400 /web-console/css/*=worker01 # Example of exclusion from mapping, logo.gif won't be displayed # !/web-console/images/logo.gif=* # Requests to /app-01 or /app-01/something will be routed to worker01 /app-01|/*=worker01 # Requests to /app-02 or /app-02/something will be routed to worker02 /app-02|/*=worker02
Create the
workers.properties
file.Theworkers.properties
file contains mapping definitions between worker labels and server instances. The following example file shows the syntax of the file. Place this file into theC:\connectors\
directory.# An entry that lists all the workers defined worker.list=worker01, worker02 # Entries that define the host and port associated with these workers # First JBoss EAP 6 server definition, port 8009 is standard port for AJP in EAP worker.worker01.host=127.0.0.1 worker.worker01.port=8009 worker.worker01.type=ajp13 # Second JBoss EAP 6 server definition worker.worker02.host= 127.0.0.100 worker.worker02.port=8009 worker.worker02.type=ajp13
Create the
rewrite.properties
file.Therewrite.properties
file contains simple URL rewriting rules for specific applications. The rewritten path is specified using name-value pairs, as shown in the example below. Place this file into theC:\connectors\
directory.#Simple example # Images are accessible under abc path /app-01/abc/=/app-01/images/
Restart the IIS server.
Restart your IIS server by using thenet stop
andnet start
commands.C:\> net stop was /Y C:\> net start w3svc
The IIS server is configured to send client requests to the specific JBoss EAP 6 servers you have configured, on an application-specific basis.
16.8.4. Configure ISAPI to Balance Client Requests Across Multiple JBoss EAP 6 Servers
This configuration balances client requests across the JBoss EAP 6 servers you specify. If you prefer to send client requests to specific JBoss EAP 6 servers on a per-deployment basis, refer to Section 16.8.3, “Configure the ISAPI Redirector to Send Client Requests to JBoss EAP 6” instead.
Prerequisites
- Full administrator access on the IIS server.
Procedure 16.12. Balance Client Requests Across Multiple Servers
Create a directory to store logs, property files, and lock files.
The rest of this procedure assumes that you are using the directoryC:\connectors\
for this purpose. If you use a different directory, modify the instructions accordingly.Create the
isapi_redirect.properties
file.Create a new file calledC:\connectors\isapi_redirect.properties
. Copy the following contents into the file.# Configuration file for the ISAPI Redirector # Extension uri definition extension_uri=C:\connectors\isapi_redirect.dll # Full path to the log file for the ISAPI Redirector log_file==c:\connectors\isapi_redirect.log # Log level (debug, info, warn, error or trace) # Use debug only testing phase, for production switch to info log_level=debug # Full path to the workers.properties file worker_file=c:\connectors\workers.properties # Full path to the uriworkermap.properties file worker_mount_file=c:\connectors\uriworkermap.properties #OPTIONAL: Full path to the rewrite.properties file rewrite_rule_file=c:\connectors\rewrite.properties
If you do not want to use arewrite.properties
file, comment out the last line by placing a#
character at the beginning of the line. See Step 5 for more information.Create the
uriworkermap.properties
file.Theuriworkermap.properties
file contains mappings between deployed application URLs and which worker handles requests to them. The following example file shows the syntax of the file, with a load-balanced configuration. The wildcard (*
) character sends all requests for various URL sub-directories to the load-balancer calledrouter
. The configuration of the load-balancer is covered in Step 4.Place youruriworkermap.properties
file intoC:\connectors\
.# images, css files, path /status and /web-console will be # provided by nodes defined in the load-balancer called "router" /css/*=router /images/*=router /status=router /web-console|/*=router # Example of exclusion from mapping, logo.gif won't be displayed !/web-console/images/logo.gif=* # Requests to /app-01 and /app-02 will be routed to nodes defined # in the load-balancer called "router" /app-01|/*=router /app-02|/*=router # mapping for management console, nodes in cluster can be enabled or disabled here /jkmanager|/*=status
Create the
workers.properties
file.Theworkers.properties
file contains mapping definitions between worker labels and server instances. The following example file shows the syntax of the file. The load balancer is configured near the end of the file, to comprise workersworker01
andworker02
. Theworkers.properties
file follows the syntax of the same file used for Apache mod_jk configuration. For more information about the syntax of theworkers.properties
file, refer to Section 16.6.4, “Configuration Reference for Apache Mod_jk Workers”.Place this file into theC:\connectors\
directory.# The advanced router LB worker worker.list=router,status # First EAP server definition, port 8009 is standard port for AJP in EAP # # lbfactor defines how much the worker will be used. # The higher the number, the more requests are served # lbfactor is useful when one machine is more powerful # ping_mode=A – all possible probes will be used to determine that # connections are still working worker.worker01.port=8009 worker.worker01.host=127.0.0.1 worker.worker01.type=ajp13 worker.worker01.ping_mode=A worker.worker01.socket_timeout=10 worker.worker01.lbfactor=3 # Second EAP server definition worker.worker02.port=8009 worker.worker02.host= 127.0.0.100 worker.worker02.type=ajp13 worker.worker02.ping_mode=A worker.worker02.socket_timeout=10 worker.worker02.lbfactor=1 # Define the LB worker worker.router.type=lb worker.router.balance_workers=worker01,worker02 # Define the status worker for jkmanager worker.status.type=status
Create the
rewrite.properties
file.Therewrite.properties
file contains simple URL rewriting rules for specific applications. The rewritten path is specified using name-value pairs, as shown in the example below. Place this file into theC:\connectors\
directory.#Simple example # Images are accessible under abc path /app-01/abc/=/app-01/images/
Restart the IIS server.
Restart your IIS server by using thenet stop
andnet start
commands.C:\> net stop was /Y C:\> net start w3svc
The IIS server is configured to send client requests to the JBoss EAP 6 servers referenced in the workers.properties
file, balancing the load equally across the servers.
16.9. Oracle NSAPI
16.9.1. About the Netscape Server API (NSAPI) HTTP Connector
16.9.2. Configure the NSAPI Connector on Oracle Solaris
The NSAPI connector is a module that runs within Oracle iPlanet Web Server.
Prerequisites
- Your server is running Oracle Solaris 10 or greater, on either a 32-bit or 64-bit architecture.
- Oracle iPlanet Web Server 7.0.15 or later for Intel architectures, or or 7.0.14 or later for SPARC architectures, is installed and configured, aside from the NSAPI connector.
- JBoss EAP 6 is installed and configured on each server which will serve as a worker node. Refer to Section 16.3.5, “Configure JBoss EAP 6 to Accept Requests From an External HTTPD”.
- The JBoss Native Components ZIP package is downloaded from the Customer Service Portal at https://access.redhat.com.
Procedure 16.13. Extract and Setup the NSAPI Connector
Extract the JBoss Native Components package.
The rest of this procedure assumes that directorylib/
orlib64/
from the Native Components package is extracted to a directory calledconnectors/
in/opt/oracle/webserver7/config/
. For the rest of this procedure, this directory will be referred to as IPLANET_CONFIG. If your Oracle iPlanet configuration directory is different, or you are running Oracle iPlanet Web Server 6, modify the procedure accordingly.Disable servlet mappings.
Open theIPLANET_CONFIG/default.web.xml
file and locate the section with the headingBuilt In Server Mappings
. Disable the mappings to the following three servlets, by wrapping them in XML comment characters (<!--
and-->
).- default
- invoker
- jsp
The following example configuration shows the disabled mappings.<!-- ============== Built In Servlet Mappings =============== --> <!-- The servlet mappings for the built in servlets defined above. --> <!-- The mapping for the default servlet --> <!--servlet-mapping> <servlet-name>default</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping--> <!-- The mapping for the invoker servlet --> <!--servlet-mapping> <servlet-name>invoker</servlet-name> <url-pattern>/servlet/*</url-pattern> </servlet-mapping--> <!-- The mapping for the JSP servlet --> <!--servlet-mapping> <servlet-name>jsp</servlet-name> <url-pattern>*.jsp</url-pattern> </servlet-mapping-->
Save and exit the file.Configure the iPlanet Web Server to load the NSAPI connector module.
Add the following lines to the end of theIPLANET_CONFIG/magnus.conf
file, modifying file paths to suit your configuration. These lines define the location of thensapi_redirector.so
module, as well as theworkers.properties
file, which lists the worker nodes and their properties.Init fn="load-modules" funcs="jk_init,jk_service" shlib="IPLANET_CONFIG/connectors/lib/nsapi_redirector.so" shlib_flags="(global|now)" Init fn="jk_init" worker_file="IPLANET_CONFIG/connectors/workers.properties" log_level="debug" log_file="IPLANET_CONFIG/config/connectors/nsapi.log" shm_file="IPLANET_CONFIG/conf/connectors/jk_shm"
The configuration above is for a 32-bit architecture. If you use 64-bit Solaris, change the stringlib/nsapi_redirector.so
tolib64/nsapi_redirector.so
.Save and exit the file.Configure the NSAPI connector.
You can configure the NSAPI connector for a basic configuration, with no load balancing, or a load-balancing configuration. Choose one of the following options, after which your configuration will be complete.
16.9.3. Configure NSAPI as a Basic HTTP Connector
This task configures the NSAPI connector to redirect client requests to JBoss EAP 6 servers with no load-balancing or fail-over. The redirection is done on a per-deployment (and hence per-URL) basis. For a load-balancing configuration, refer to Section 16.9.4, “Configure NSAPI as a Load-balancing Cluster” instead.
Prerequisites
- You must complete Section 16.9.2, “Configure the NSAPI Connector on Oracle Solaris” before continuing with the current task.
Procedure 16.14. Setup the Basic HTTP Connector
Define the URL paths to redirect to the JBoss EAP 6 servers.
Note
InIPLANET_CONFIG/obj.conf
, spaces are not allowed at the beginning of a line, except when the line is a continuation of the previous line.Edit theIPLANET_CONFIG/obj.conf
file. Locate the section which starts with<Object name="default">
, and add each URL pattern to match, in the format shown by the example file below. The stringjknsapi
refers to the HTTP connector which will be defined in the next step. The example shows the use of wildcards for pattern matching.<Object name="default"> [...] NameTrans fn="assign-name" from="/status" name="jknsapi" NameTrans fn="assign-name" from="/images(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/css(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/nc(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/jmx-console(|/*)" name="jknsapi" </Object>
Define the worker which serves each path.
Continue editing theIPLANET_CONFIG/obj.conf
file. Add the following directly after the closing tag of the section you have just finished editing:</Object>
.<Object name="jknsapi"> ObjectType fn=force-type type=text/plain Service fn="jk_service" worker="worker01" path="/status" Service fn="jk_service" worker="worker02" path="/nc(/*)" Service fn="jk_service" worker="worker01" </Object>
The example above redirects requests to the URL path/status
to the worker calledworker01
, and all URL paths beneath/nc/
to the worker calledworker02
. The third line indicates that all URLs assigned to thejknsapi
object which are not matched by the previous lines are served toworker01
.Save and exit the file.Define the workers and their attributes.
Create a file calledworkers.properties
in the
directory. Paste the following contents into the file, and modify them to suit your environment.IPLANET_CONFIG
/connectors/# An entry that lists all the workers defined worker.list=worker01, worker02 # Entries that define the host and port associated with these workers worker.worker01.host=127.0.0.1 worker.worker01.port=8009 worker.worker01.type=ajp13 worker.worker02.host=127.0.0.100 worker.worker02.port=8009 worker.worker02.type=ajp13
Theworkers.properties
file uses the same syntax as Apache mod_jk. For information about which options are available, refer to Section 16.6.4, “Configuration Reference for Apache Mod_jk Workers”.Save and exit the file.Restart the iPlanet Web Server.
Issue the following command to restart the iPlanet Web Server.IPLANET_CONFIG/../bin/stopserv IPLANET_CONFIG/../bin/startserv
iPlanet Web Server now sends client requests to the URLs you have configured to deployments on JBoss EAP 6.
16.9.4. Configure NSAPI as a Load-balancing Cluster
This task configures the NSAPI connector to redirect client requests to JBoss EAP 6 servers in a load-balancing configuration. To use NSAPI as a simple HTTP connector with no load-balancing, refer to Section 16.9.3, “Configure NSAPI as a Basic HTTP Connector” instead.
Prerequisites
- You must complete Section 16.9.2, “Configure the NSAPI Connector on Oracle Solaris” before continuing with the current task.
Procedure 16.15. Configure the Connector for Load-Balancing
Define the URL paths to redirect to the JBoss EAP 6 servers.
Note
InIPLANET_CONFIG/obj.conf
, spaces are not allowed at the beginning of a line, except when the line is a continuation of the previous line.Edit theIPLANET_CONFIG/obj.conf
file. Locate the section which starts with<Object name="default">
, and add each URL pattern to match, in the format shown by the example file below. The stringjknsapi
refers to the HTTP connector which will be defined in the next step. The example shows the use of wildcards for pattern matching.<Object name="default"> [...] NameTrans fn="assign-name" from="/status" name="jknsapi" NameTrans fn="assign-name" from="/images(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/css(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/nc(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/jmx-console(|/*)" name="jknsapi" NameTrans fn="assign-name" from="/jkmanager/*" name="jknsapi" </Object>
Define the worker that serves each path.
Continue editing theIPLANET_CONFIG/obj.conf
file. Directly after the closing tag for the section you modified in the previous step (</Object>
), add the following new section and modify it to your needs:<Object name="jknsapi"> ObjectType fn=force-type type=text/plain Service fn="jk_service" worker="status" path="/jkmanager(/*)" Service fn="jk_service" worker="router" </Object>
Thisjksnapi
object defines the worker nodes used to serve each path that was mapped to thename="jksnapi"
mapping in thedefault
object. Everything except for URLs matching/jkmanager/*
is redirected to the worker calledrouter
.Define the workers and their attributes.
Create a file calledworkers.properties
in
. Paste the following contents into the file, and modify them to suit your environment.IPLANET_CONFIG
/connector/# The advanced router LB worker # A list of each worker worker.list=router,status # First JBoss EAP server # (worker node) definition. # Port 8009 is the standard port for AJP # worker.worker01.port=8009 worker.worker01.host=127.0.0.1 worker.worker01.type=ajp13 worker.worker01.ping_mode=A worker.worker01.socket_timeout=10 worker.worker01.lbfactor=3 # Second JBoss EAP server worker.worker02.port=8009 worker.worker02.host=127.0.0.100 worker.worker02.type=ajp13 worker.worker02.ping_mode=A worker.worker02.socket_timeout=10 worker.worker02.lbfactor=1 # Define the load-balancer called "router" worker.router.type=lb worker.router.balance_workers=worker01,worker02 # Define the status worker worker.status.type=status
Theworkers.properties
file uses the same syntax as Apache mod_jk. For information about which options are available, refer to Section 16.6.4, “Configuration Reference for Apache Mod_jk Workers”.Save and exit the file.Restart the iPlanet Web Server.
Choose one of the following procedures, depending on whether you run iPlanet Web Server 6.1 or 7.0.iPlanet Web Server 6.1
IPLANET_CONFIG/../stop IPLANET_CONFIG/../start
iPlanet Web Server 7.0
IPLANET_CONFIG/../bin/stopserv IPLANET_CONFIG/../bin/startserv
The iPlanet Web Server redirects the URL patterns you have configured to your JBoss EAP 6 servers in a load-balancing configuration.
Chapter 17. Messaging
17.1. Introduction
17.1.1. HornetQ
17.1.2. About Java Messaging Service (JMS)
17.1.3. Supported Messaging Styles
- Message Queue pattern
- The Message Queue pattern involves sending a message to a queue. Once in the queue, the message is usually made persistent to guarantee delivery. Once the message has moved through the queue, the messaging system delivers it to a message consumer. The message consumer acknowledges the delivery of the message once it is processed.When used with point-to-point messaging, the Message Queue pattern allows multiple consumers for a queue, but each message can only be received by a single consumer.
- Publish-Subscribe pattern
- The Publish-Subscribe pattern allows multiple senders to send messages to a single entity on the server. This entity is often known as a "topic". Each topic can be attended by multiple consumers, known as "subscriptions".Each subscription receives a copy of every message sent to the topic. This differs from the Message Queue pattern, where each message is only consumed by a single consumer.Subscriptions that are durable retain copies of each message sent to the topic until the subscriber consumes them. These copies are retained even in the event of a server restart. Non-durable subscriptions last only as long as the connection that created them.
17.2. About Acceptors and Connectors
Acceptors and Connectors
Acceptor
- An acceptor defines which types of connections are accepted by the HornetQ server.
Connector
- A connector defines how to connect to a HornetQ server, and is used by the HornetQ client.
Invm and Netty
Invm
- Invm is short for Intra Virtual Machine. It can be used when both the client and the server are running in the same JVM.
Netty
- The name of a JBoss project. It must be used when the client and server are running in different JVMs.
standalone.xml
and domain.xml
. You can use either the Management Console or the Management CLI to define them.
Example 17.1. Example of the Default Acceptor and Connector Configuration
<connectors> <netty-connector name="netty" socket-binding="messaging"/> <netty-connector name="netty-throughput" socket-binding="messaging-throughput"> <param key="batch-delay" value="50"/> </netty-connector> <in-vm-connector name="in-vm" server-id="0"/> </connectors> <acceptors> <netty-acceptor name="netty" socket-binding="messaging"/> <netty-acceptor name="netty-throughput" socket-binding="messaging-throughput"> <param key="batch-delay" value="50"/> <param key="direct-deliver" value="false"/> </netty-acceptor> <in-vm-acceptor name="in-vm" server-id="0"/> </acceptors>
17.3. About Bridges
17.4. About Java Naming and Directory Interface (JNDI)
17.5. Work with Large Messages
17.6. Configuration
17.6.1. Configure the JMS Server
EAP_HOME/domain/configuration/domain.xml
file for domain servers, or in the EAP_HOME/standalone/configuration/standalone.xml
file for standalone servers.
<subsystem xmlns="urn:jboss:domain:messaging:1.3">
element contains all JMS configuration. Add any JMS ConnectionFactory
, Queue
, or Topic
instances required for the JNDI.
Enable the JMS subsystem in JBoss EAP 6.
In the<extensions>
element, verify that the following line is present and is not commented out:<extension module="org.jboss.as.messaging"/>
Add the basic JMS subsystem.
If the Messaging subsystem is not present in your configuration file, add it.- Look for the
<profile>
which corresponds to the profile you use, and locate its<subsystems>
tag. - Add a new line just beneath the
<subsystems>
tag. Paste the following into it:<subsystem xmlns="urn:jboss:domain:messaging:1.3"> </subsystem>
All further configuration will be added to the empty line above.
Add basic configuration for JMS.
<journal-file-size>102400</journal-file-size> <journal-min-files>2</journal-min-files> <journal-type>NIO</journal-type> <!-- disable messaging persistence --> <persistence-enabled>false</persistence-enabled>
Customize the values above to meet your needs.Warning
The value ofjournal-file-size
must be higher than the size of message sent to server, or the server won't be able to store the message.Add connection factory instances to HornetQ
The client uses a JMSConnectionFactory
object to make connections to the server. To add a JMS connection factory object to HornetQ, include a single<jms-connection-factories>
tag and<connection-factory>
element for each connection factory as follows:<subsystem xmlns="urn:jboss:domain:messaging:1.3"> ... <jms-connection-factories> <connection-factory name="myConnectionFactory"> <connectors> <connector-ref connector-name="netty"/> </connectors> <entries> <entry name="/ConnectionFactory"/> </entries> </connection-factory> </jms-connection-factories> ... </subsystem>
Configure the
netty
connectorThis JMS connection factory uses anetty
connector. This is a reference to a connector object deployed in the server configuration file. The connector object defines the transport and parameters used to actually connect to the server.To configure thenetty
connector, include the following settings:<subsystem xmlns="urn:jboss:domain:messaging:1.3"> ... <connectors> <netty-connector name="netty" socket-binding="messaging"/> <netty-connector name="netty-throughput" socket-binding="messaging-throughput"> <param key="batch-delay" value="50"/> </netty-connector> <in-vm-connector name="in-vm" server-id="0"/> </connectors> ... </subsystem>
The connector references themessaging
andmessaging-throughput
socket bindings. Themessaging
socket binding uses port 5445, and themessaging-throughput
socket binding uses port 5455. Ensure the following socket bindings are present in the<socket-binding-groups>
element:<socket-binding-groups> ... <socket-binding-group ... > <socket-binding name="messaging" port="5445"/> <socket-binding name="messaging-throughput" port="5455"/> ... </socket-binding-group> ... </socket-binding-groups>
Add queue instances to HornetQ
There are 4 ways to setup the queue instances (or JMS destinations) for HornetQ.- Use the Management ConsoleTo use the Management Console, the server must have been started in the
Message-Enabled
mode. You can do this by using the-c
option and forcing the use of thestandalone-full.xml
(for standalone servers) configuration file. For example, in the standalone mode, the following will start the server in a message enabled mode./standalone.sh -c standalone-full.xml
Once the server has started, logon to the Management Console and navigate to: Profile → Messaging → Destinations → default → View, and then click the add button to enter details of the JMS destination. - Use the Management CLI:First, connect to the Management CLI:
bin/jboss-cli.sh --connect
Next, change into the messaging subsystem:cd /subsystem=messaging/hornetq-server=default
Finally, execute an add operation, replacing the examples values given below with your own:./jms-queue=testQueue:add(durable=false,entries=["java:jboss/exported/jms/queue/test"])
- Create a JMS configuration file and add it to the deployments folderStart by creating a JMS configuration file: example-jms.xml. Add the following entries to it, replacing the values with your own:
<?xml version="1.0" encoding="UTF-8"?> <messaging-deployment xmlns="urn:jboss:messaging-deployment:1.0"> <hornetq-server> <jms-destinations> <jms-queue name="testQueue"> <entry name="queue/test"/> <entry name="java:jboss/exported/jms/queue/test"/> </jms-queue> <jms-topic name="testTopic"> <entry name="topic/test"/> <entry name="java:jboss/exported/jms/topic/test"/> </jms-topic> </jms-destinations> </hornetq-server> </messaging-deployment>
Save this file in the deployments folder and do a deployment. - Add entries in the JBoss EAP 6 configuration file.Using the standalone-full.xml as an example, find the messaging subsystem in this file.
<subsystem xmlns="urn:jboss:domain:messaging:1.3">
Add the following entries in it, again, replacing the example values with your own. You will need to add these entries in after the </jms-connection-factories> end tag but before the </hornetq-server> element:<jms-destinations> <jms-queue name="testQueue"> <entry name="queue/test"/> <entry name="java:jboss/exported/jms/queue/test"/> </jms-queue> <jms-topic name="testTopic"> <entry name="topic/test"/> <entry name="java:jboss/exported/jms/topic/test"/> </jms-topic> </jms-destinations>
Perform additional configuration
If you need additional settings, review the DTD inEAP_HOME/docs/schema/jboss-messaging_1_3.xsd
.
17.6.2. Configure JMS Address Settings
<address-settings>
configuration element.
Address wildcards can be used to match multiple similar addresses with a single statement, similar to how many systems use the asterisk ( *) character to match multiple files or strings with a single search. The following characters have special significance in a wildcard statement.
Table 17.1. JMS Wildcard Syntax
Character | Description |
---|---|
. (a single period) | Denotes the space between words in a wildcard expression. |
# (a pound or hash symbol) | Matches any sequence of zero or more words. |
* (an asterisk) | Matches a single word. |
Table 17.2. JMS Wildcard Examples
Example | Description |
---|---|
news.europe.# |
Matches
news.europe , news.europe.sport , news.europe.politic , but not news.usa or europe .
|
news. |
Matches
news.europe but not news.europe.sport .
|
news.*.sport |
Matches
news.europe.sport and news.usa.sport , but not news.europe.politics .
|
Example 17.2. Default Address Setting Configuration
<address-settings> <!--default for catch all--> <address-setting match="#"> <dead-letter-address>jms.queue.DLQ</dead-letter-address> <expiry-address>jms.queue.ExpiryQueue</expiry-address> <redelivery-delay>0</redelivery-delay> <max-size-bytes>10485760</max-size-bytes> <address-full-policy>BLOCK</address-full-policy> <message-counter-history-day-limit>10</message-counter-history-day-limit> </address-setting> </address-settings>
Table 17.3. Description of JMS Address Settings
Element | Description | Default Value | Type |
---|---|---|---|
address-full-policy
|
Determines what happens when an address where max-size-bytes is specified becomes full.
|
PAGE
|
STRING
|
dead-letter-address
|
If a dead letter address is specified, messages are moved to the dead letter address if
max-delivery-attempts delivery attempts have failed. Otherwise, these undelivered messages are discarded. Wildcards are allowed.
|
jms.queue.DLQ
|
STRING
|
expiry-address
|
If the expiry address is present, expired messages are sent to the address or addresses matched by it, instead of being discarded. Wildcards are allowed.
|
jms.queue.ExpiryQueue
|
STRING
|
last-value-queue
|
Defines whether a queue only uses last values or not.
|
false
|
BOOLEAN
|
max-delivery-attempts
|
The maximum number of times to attempt to re-deliver a message before it is sent to
dead-letter-address or discarded.
|
10
|
INT
|
max-size-bytes
|
The maximum bytes size.
|
10485760L
|
LONG
|
message-counter-history-day-limit
|
Day limit for the message counter history.
|
10
|
INT
|
page-max-cache-size
|
The number of page files to keep in memory to optimize IO during paging navigation.
|
5
|
INT
|
page-size-bytes
|
The paging size.
|
5
|
INT
|
redelivery-delay
|
Time to delay between re-delivery attempts of messages, expressed in milliseconds. If set to
0 , re-delivery attempts occur indefinitely.
|
0L
|
LONG
|
redistribution-delay
|
Defines how long to wait when the last consumer is closed on a queue before redistributing any messages.
|
-1L
|
LONG
|
send-to-dla-on-no-route
|
A parameter for an address that sets the condition of a message not routed to any queues to instead be sent the to the dead letter address (DLA) indicated for that address.
|
false
|
BOOLEAN
|
Configure Address Setting and Pattern Attributes
Choose either the Management CLI or the Management Console to configure your pattern attributes as required.Configure the Address Settings Using the Management CLI
Use the Management CLI to configure address settings.Add a New Pattern
Use theadd
operation to create a new address setting if required. You can run this command from the root of the Management CLI session, which in the following examples creates a new pattern titled patternname, with amax-delivery-attempts
attribute declared as 5. The examples for both Standalone Server and a Managed Domain editing on thefull
profile are shown.[domain@localhost:9999 /] /profile=full/subsystem=messaging/hornetq-server=default/address-setting=patternname/:add(max-delivery-attempts=5)
[standalone@localhost:9999 /] /subsystem=messaging/hornetq-server=default/address-setting=patternname/:add(max-delivery-attempts=5)
Edit Pattern Attributes
Use thewrite
operation to write a new value to an attribute. You can use tab completion to help complete the command string as you type, as well as to expose the available attributes. The following example updates themax-delivery-attempts
value to 10[domain@localhost:9999 /] /profile=full/subsystem=messaging/hornetq-server=default/address-setting=patternname/:write-attribute(name=max-delivery-attempts,value=10)
[standalone@localhost:9999 /] /subsystem=messaging/hornetq-server=default/address-setting=patternname/:write-attribute(name=max-delivery-attempts,value=10)
Confirm Pattern Attributes
Confirm the values are changed by running theread-resource
operation with theinclude-runtime=true
parameter to expose all current values active in the server model.[domain@localhost:9999 /] /profile=full/subsystem=messaging/hornetq-server=default/address-setting=patternname/:read-resource
[standalone@localhost:9999 /] /subsystem=messaging/hornetq-server=default/address-setting=patternname/:read-resource
Configure the Address Settings Using the Management Console
Use the Management Console to configure address settings.Log into the Management Console.
Log into the Management Console of your Managed Domain or Standalone Server.If you use a Managed Domain, choose the correct profile.
Select the Profiles tab at the top right, and then select the correct profile from the Profile menu at the top left of the next screen. Only thefull
andfull-ha
profiles have themessaging
subsystem enabled.Select the Messaging item from the navigation menu.
Expand the Messaging menu item from the navigation menu, and click Destinations.View the JMS Provider.
A list of JMS Providers is shown. In the default configuration, only one provider, calleddefault
, is shown. Click the View link to view the detailed settings for this provider.View the Address Settings.
Click the Addressing tab. Either add a new pattern by clicking the Add button, or edit an existing one by clicking its name and clicking the Edit button.Configure the options.
If you are adding a new pattern, the Pattern field refers to thematch
parameter of theaddress-setting
element. You can also edit the Dead Letter Address, Expiry Address, Redelivery Delay, and Max Delivery Attempts. Other options need to be configured using the Management CLI.
17.6.3. Configure Messaging with HornetQ
standalone.xml
or domain.xml
configuration files. It is useful however to familiarize yourself with the messaging components of the default configuration files, where documentation examples using management tools give configuration file snippets for reference.
17.6.4. Configure Delayed Redelivery
Delayed redelivery is defined in the <redelivery-delay>
element, which is a child element of the <address-setting>
configuration element in the Java Messaging Service (JMS) subsystem configuration.
<!-- delay redelivery of messages for 5s --> <address-setting match="jms.queue.exampleQueue"> <redelivery-delay>5000</redelivery-delay> </address-setting>
<redelivery-delay>
is set to 0
, there is no redelivery delay. Address wildcards can be used on the <address-setting-match>
element to configure the redelivery delay for addresses which match the wildcard.
17.6.5. Configure Dead Letter Addresses
A dead letter address is defined in the <address-setting>
element of the Java Messaging Service (JMS) subsystem configuration.
<!-- undelivered messages in exampleQueue will be sent to the dead letter address deadLetterQueue after 3 unsuccessful delivery attempts --> <address-setting match="jms.queue.exampleQueue"> <dead-letter-address>jms.queue.deadLetterQueue</dead-letter-address> <max-delivery-attempts>3</max-delivery-attempts> </address-setting>
<dead-letter-address>
is not specified, messages are removed after trying to deliver <max-delivery-attempts>
times. By default, messages delivery is attempted 10 times. Setting <max-delivery-attempts>
to -1
allows infinite redelivery attempts. For example, a dead letter can be set globally for a set of matching addresses and you can set <max-delivery-attempts>
to -1
for a specific address setting to allow infinite redelivery attempts only for this address. Address wildcards can also be used to configure dead letter settings for a set of addresses.
17.6.6. Configure Message Expiry Addresses
Message expiry addresses are defined in the address-setting configuration of the Java Messaging Service (JMS). For example:
<!-- expired messages in exampleQueue will be sent to the expiry address expiryQueue --> <address-setting match="jms.queue.exampleQueue"> <expiry-address>jms.queue.expiryQueue</expiry-address> </address-setting>
Address wildcards can be used to match multiple similar addresses with a single statement, similar to how many systems use the asterisk (*) character to match multiple files or strings with a single search. The following characters have special significance in a wildcard statement.
Table 17.4. JMS Wildcard Syntax
Character | Description |
---|---|
. (a single period) | Denotes the space between words in a wildcard expression. |
# (a pound or hash symbol) | Matches any sequence of zero or more words. |
* (an asterisk) | Matches a single word. |
Table 17.5. JMS Wildcard Examples
Example | Description |
---|---|
news.europe.# |
Matches
news.europe , news.europe.sport , news.europe.politic , but not news.usa or europe .
|
news. |
Matches
news.europe but not news.europe.sport .
|
news.*.sport |
Matches
news.europe.sport and news.usa.sport , but not news.europe.politics .
|
17.6.7. Reference for HornetQ Configuration Attributes
read-resource
operation.
Example 17.3. Example
[standalone@localhost:9999 /] /subsystem=messaging/hornetq-server=default:read-resource
Table 17.6. HornetQ Attributes
Attribute | Example Value | Type |
---|---|---|
allow-failback | true | BOOLEAN |
async-connection-execution-enabled | true | BOOLEAN |
backup | false | BOOLEAN |
cluster-password | somethingsecure | STRING |
cluster-user | HORNETQ.CLUSTER.ADMIN.USER | STRING |
clustered | false | BOOLEAN |
connection-ttl-override | -1 | LONG |
create-bindings-dir | true | BOOLEAN |
create-journal-dir | true | BOOLEAN |
failback-delay | 5000 | LONG |
failover-on-shutdown | false | BOOLEAN |
id-cache-size | 2000 | INT |
jmx-domain | org.hornetq | STRING |
jmx-management-enabled | false | BOOLEAN |
journal-buffer-size | 100 | LONG |
journal-buffer-timeout | 100 | LONG |
journal-compact-min-files | 10 | INT |
journal-compact-percentage | 30 | INT |
journal-file-size | 102400 | LONG |
journal-max-io | 1 | INT |
journal-min-files | 2 | INT |
journal-sync-non-transactional | true | BOOLEAN |
journal-sync-transactional | true | BOOLEAN |
journal-type | ASYNCIO | STRING |
live-connector-ref | reference | STRING |
log-journal-write-rate | false | BOOLEAN |
management-address | jms.queue.hornetq.management | STRING |
management-notification-address | hornetq.notifications | STRING |
memory-measure-interval | -1 | LONG |
memory-warning-threshold | 25 | INT |
message-counter-enabled | false | BOOLEAN |
message-counter-max-day-history | 10 | INT |
message-counter-sample-period | 10000 | LONG |
message-expiry-scan-period | 30000 | LONG |
message-expiry-thread-priority | 3 | INT |
page-max-concurrent-io | 5 | INT |
perf-blast-pages | -1 | INT |
persist-delivery-count-before-delivery | false | BOOLEAN |
persist-id-cache | true | BOOLEAN |
persistence-enabled | true | BOOLEAN |
remoting-interceptors | undefined | LIST |
run-sync-speed-test | false | BOOLEAN |
scheduled-thread-pool-max-size | 5 | INT |
security-domain | other | STRING |
security-enabled | true | BOOLEAN |
security-invalidation-interval | 10000 | LONG |
server-dump-interval | -1 | LONG |
shared-store | true | BOOLEAN |
started | true | BOOLEAN |
thread-pool-max-size | 30 | INT |
transaction-timeout | 300000 | LONG |
transaction-timeout-scan-period | 1000 | LONG |
version | 2.2.16.Final (HQ_2_2_16_FINAL, 122) | STRING |
wild-card-routing-enabled | true | BOOLEAN |
Warning
journal-file-size
must be higher than the size of message sent to server, or the server won't be able to store the message.
17.6.8. Set Message Expiry
Using HornetQ Core API, the expiration time can be set directly on the message. For example:
// message will expire in 5000ms from now message.setExpiration(System.currentTimeMillis() + 5000);
MessageProducer
JMS MessageProducer
includes a TimeToLive
parameter which controls message expiry for the messages it sends:
// messages sent by this producer will be retained for 5s (5000ms) before expiration producer.setTimeToLive(5000);
- _HQ_ORIG_ADDRESS
- _HQ_ACTUAL_EXPIRY
17.7. Persistence
17.7.1. About Persistence in HornetQ
- Java New I/O (NIO)Uses standard Java NIO to interface with the file system. This provides extremely good performance and runs on any platform with a Java 6 or later runtime.
- Linux Asynchronous IO (AIO)Uses a native code wrapper to talk to the Linux asynchronous IO library (AIO). With AIO, HornetQ receives a message when data has been persisted. This removes the need for explicit syncs. AIO will typically provide better performance than Java NIO, but requires Linux kernel 2.6 or later and the libaio package.AIO also requires ext2, ext3, ext4, jfs or xfs type file systems.
- bindings journalStores bindings-related data, including the set of queues deployed on the server and their attributes. It also stores data such as ID sequence counters. The bindings journal is always a NIO journal, as it typically has low throughput in comparison to the message journal.The files on this journal are prefixed as hornetq-bindings. Each file has a bindings extension. File size is 1048576 bytes, and it is located in the bindings folder.
- JMS journalStores all JMS-related data, for example, any JMS queues, topics or connection factories and any JNDI bindings for these resources. Any JMS resources created with the management API are persisted to this journal. Any resources configured with configuration files are not. This journal is created only if JMS is in use.
- message journalStores all message-related data, including messages themselves and duplicate-id caches. By default, HornetQ uses AIO for this journal. If AIO is not available, it will automatically fall back to NIO.
17.8. High Availability
17.8.1. About HornetQ Shared Stores
Important
- GFS2 on a SAN, using the ASYNCIO journal type.
- NFSv4, using either the ASYNCIO or NIO journal type.
Important
Warning
- HornetQ must be configured to use one of the following journal types: ASYNCIO/AIO or NIO.
- The Red Hat Enterprise Linux NFS client cache must be disabled.
Important
Important
libaio
is installed on the Red Hat Enterprise Linux system where JBoss EAP 6 is running.
Note
17.8.2. About High-availability (HA) Failover
Important
Important
17.9. Message Replication
17.9.1. HornetQ Message Replication
Warning
backup-group-name
parameter has been defined in the hornetq-configuration.xml
file. A backup server will only connect to a live server that shares the same group name. In the absence of this parameter, a backup server will try and connect to any live server.
17.9.2. Configuring the HornetQ Servers for Replication
hornetq-configuration.xml
files to have:
<shared-store>false</shared-store> . . . <cluster-connections> <cluster-connection name="my-cluster"> ... </cluster-connection> </cluster-connections>
<backup>true</backup> <connectors> <connector name="nameOfConfiguredLiveServerConnector"> <factory-class> org.hornetq.core.remoting.impl.netty.NettyConnectorFactory </factory-class> <param key="port" value="5445"/> </connector> <!-- a real configuration could have more connectors here --> <connectors>
Chapter 18. Transaction Subsystem
18.1. Transaction Subsystem Configuration
18.1.1. Transactions Configuration Overview
The following procedures show you how to configure the transactions subsystem of JBoss EAP 6.
18.1.2. Configure the Transaction Manager
default
, you may need to modify the steps and commands in the following ways.
Notes about the Example Commands
- For the Management Console, the
default
profile is the one which is selected when you first log into the console. If you need to modify the Transaction Manager's configuration in a different profile, select your profile instead ofdefault
, in each instruction.Similarly, substitute your profile for thedefault
profile in the example CLI commands. - If you use a Standalone Server, only one profile exists. Ignore any instructions to choose a specific profile. In CLI commands, remove the
/profile=default
portion of the sample commands.
Note
transactions
subsystem must be enabled. It is enabled by default, and required for many other subsystems to function properly, so it is very unlikely that it would be disabled.
To configure the TM using the web-based Management Console, select the Runtime tab from the list in the upper left side of the Management Console screen. If you use a managed domain, you have the choice of several profiles. Choose the correct one from the Profile selection box at the upper right of the Profiles screen. Expand the Container menu and select Transactions.
In the Management CLI, you can configure the TM using a series of commands. The commands all begin with /profile=default/subsystem=transactions/
for a managed domain with profile default
, or /subsystem=transactions
for a Standalone Server.
Table 18.1. TM Configuration Options
Option | Description | CLI Command |
---|---|---|
Enable Statistics
|
Whether to enable transaction statistics. These statistics can be viewed in the Management Console in the Subsystem Metrics section of the Runtime tab.
| /profile=default/subsystem=transactions/:write-attribute(name=enable-statistics,value=true)
|
Default Timeout
|
The default transaction timeout. This defaults to
300 seconds. You can override this programmatically, on a per-transaction basis.
| /profile=default/subsystem=transactions/:write-attribute(name=default-timeout,value=300)
|
Path
|
The relative or absolute filesystem path where the transaction manager core stores data. By default the value is a path relative to the value of the
relative-to attribute. The path is used to save the process ID when the process-id tag (or the process-id-uuid CLI attribute ) is used.
| /profile=default/subsystem=transactions/:write-attribute(name=path,value=var)
|
Relative To
|
References a global path configuration in the domain model. The default value is the data directory for JBoss EAP 6, which is the value of the property
jboss.server.data.dir , and defaults to EAP_HOME/domain/data/ for a Managed Domain, or EAP_HOME/standalone/data/ for a Standalone Server instance. The value of the path TM attribute is relative to this path.
| /profile=default/subsystem=transactions/:write-attribute(name=relative-to,value=jboss.server.data.dir)
|
Object Store Path
|
A relative or absolute filesystem path where the TM object store stores data. By default relative to the
object-store-relative-to parameter's value.
| /profile=default/subsystem=transactions/:write-attribute(name=object-store-path,value=tx-object-store)
|
Object Store Path Relative To
|
References a global path configuration in the domain model. The default value is the data directory for JBoss EAP 6, which is the value of the property
jboss.server.data.dir , and defaults to EAP_HOME/domain/data/ for a Managed Domain, or EAP_HOME/standalone/data/ for a Standalone Server instance. The value of the object store path TM attribute is relative to this path.
| /profile=default/subsystem=transactions/:write-attribute(name=object-store-relative-to,value=jboss.server.data.dir)
|
Socket Binding
|
Specifies the name of the socket binding used by the Transaction Manager for recovery and generating transaction identifiers, when the socket-based mechanism is used. Refer to
process-id-socket-max-ports for more information on unique identifier generation. Socket bindings are specified per server group in the Server tab of the Management Console.
| /profile=default/subsystem=transactions/:write-attribute(name=socket-binding,value=txn-recovery-environment)
|
Recovery Listener
|
Whether or not the Transaction Recovery process should listen on a network socket. Defaults to
false .
| /profile=default/subsystem=transactions/:write-attribute(name=recovery-listener,value=false)
|
Table 18.2. Advanced TM Configuration Options
Option | Description | CLI Command |
---|---|---|
jts
|
Whether to use Java Transaction Service (JTS) transactions. Defaults to
false , which uses JTA transactions only.
| /profile=default/subsystem=transactions/:write-attribute(name=jts,value=false)
|
node-identifier
|
The node identifier for the JTS service. This should be unique per JTS service, because the Transaction Manager uses this for recovery.
| /profile=default/subsystem=transactions/:write-attribute(name=node-identifier,value=1)
|
process-id-socket-max-ports
|
The Transaction Manager creates a unique identifier for each transaction log. Two different mechanisms are provided for generating unique identifiers: a socket-based mechanism and a mechanism based on the process identifier of the process.
In the case of the socket-based identifier, a socket is opened and its port number is used for the identifier. If the port is already in use, the next port is probed, until a free one is found. The
process-id-socket-max-ports represents the maximum number of sockets the TM will try before failing. The default value is 10 .
| /profile=default/subsystem=transactions/:write-attribute(name=process-id-socket-max-ports,value=10)
|
process-id-uuid
|
Set to
true to use the process identifier to create a unique identifier for each transaction. Otherwise, the socket-based mechanism is used. Defaults to true . Refer to process-id-socket-max-ports for more information.
| /profile=default/subsystem=transactions/:write-attribute(name=process-id-uuid,value=true)
|
use-hornetq-store
|
Use HornetQ's journaled storage mechanisms instead of file-based storage, for the transaction logs. This is disabled by default, but can improve I/O performance. It is not recommended for JTS transactions on separate Transaction Managers. .
| /profile=default/subsystem=transactions/:write-attribute(name=use-hornetq-store,value=false)
|
18.1.3. Configure Your Datasource to Use JTA Transactions
This task shows you how to enable Java Transactions API (JTA) on your datasource.
You must meet the following conditions before continuing with this task:
- Your database or other resource must support JTA. If in doubt, consult the documentation for your database or other resource.
- Create a datasource. Refer to Section 6.3.1, “Create a Non-XA Datasource with the Management Interfaces”.
- Stop JBoss EAP 6.
- Have access to edit the configuration files directly, in a text editor.
Procedure 18.1. Configure the Datasource to use JTA Transactions
Open the configuration file in a text editor.
Depending on whether you run JBoss EAP 6 in a managed domain or standalone server, your configuration file will be in a different location.Managed domain
The default configuration file for a managed domain is inEAP_HOME/domain/configuration/domain.xml
for Red Hat Enterprise Linux, andEAP_HOME\domain\configuration\domain.xml
for Microsoft Windows Server.Standalone server
The default configuration file for a standalone server is inEAP_HOME/standalone/configuration/standalone.xml
for Red Hat Enterprise Linux, andEAP_HOME\standalone\configuration\standalone.xml
for Microsoft Windows Server.
Locate the
<datasource>
tag that corresponds to your datasource.The datasource will have thejndi-name
attribute set to the one you specified when you created it. For example, the ExampleDS datasource looks like this:<datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="H2DS" enabled="true" jta="true" use-java-context="true" use-ccm="true">
Set the
jta
attribute totrue
.Add the following to the contents of your<datasource>
tag, as they appear in the previous step:jta="true"
Save the configuration file.
Save the configuration file and exit the text editor.Start JBoss EAP 6.
Relaunch the JBoss EAP 6 server.
JBoss EAP 6 starts, and your datasource is configured to use JTA transactions.
18.1.4. Configure an XA Datasource
In order to add an XA Datasource, you need to log into the Management Console. See Section 3.4.2, “Log in to the Management Console” for more information.
Add a new datasource.
Add a new datasource to JBoss EAP 6. Follow the instructions in Section 6.3.1, “Create a Non-XA Datasource with the Management Interfaces”, but click the XA Datasource tab at the top.Configure additional properties as appropriate.
All datasource parameters are listed in Section 6.6.1, “Datasource Parameters”.
Your XA Datasource is configured and ready to use.
18.1.5. About Transaction Log Messages
DEBUG
log level for the transaction logger. For detailed debugging, use the TRACE
log level. Refer to Section 18.1.6, “Configure Logging for the Transaction Subsystem” for information on configuring the transaction logger.
TRACE
log level. Following are some of the most commonly-seen messages. This list is not comprehensive, so you may see other messages than these.
Table 18.3. Transaction State Change
Transaction Begin |
When a transaction begins, the following code is executed:
com.arjuna.ats.arjuna.coordinator.BasicAction::Begin:1342 tsLogger.logger.trace("BasicAction::Begin() for action-id "+ get_uid()); |
Transaction Commit |
When a transaction commits, the following code is executed:
com.arjuna.ats.arjuna.coordinator.BasicAction::End:1342 tsLogger.logger.trace("BasicAction::End() for action-id "+ get_uid()); |
Transaction Rollback |
When a transaction rolls back, the following code is executed:
com.arjuna.ats.arjuna.coordinator.BasicAction::Abort:1575 tsLogger.logger.trace("BasicAction::Abort() for action-id "+ get_uid()); |
Transaction Timeout |
When a transaction times out, the following code is executed:
com.arjuna.ats.arjuna.coordinator.TransactionReaper::doCancellations:349 tsLogger.logger.trace("Reaper Worker " + Thread.currentThread() + " attempting to cancel " + e._control.get_uid());
You will then see the same thread rolling back the transaction as shown above.
|
18.1.6. Configure Logging for the Transaction Subsystem
Use this procedure to control the amount of information logged about transactions, independent of other logging settings in JBoss EAP 6. The main procedure shows how to do this in the web-based Management Console. The Management CLI command is given afterward.
Procedure 18.2. Configure the Transaction Logger Using the Management Console
Navigate to the Logging configuration area.
In the Management Console, click the Profiles tab at the top left of the screen. If you use a managed domain, choose the server profile you wish to configure, from the Profile selection box at the top right.Expand the Core menu, and click the Logging label.Edit the
com.arjuna
attributes.Click the Edit button in the Details section, toward the bottom of the page. This is where you can add class-specific logging information. Thecom.arjuna
class is already present. You can change the log level and whether to use parent handlers.- Log Level
- The log level is
WARN
by default. Because transactions can produce a large quantity of logging output, the meaning of the standard logging levels is slightly different for the transaction logger. In general, messages tagged with levels at a lower severity than the chosen level are discarded.Transaction Logging Levels, from Most to Least Verbose
- TRACE
- DEBUG
- INFO
- WARN
- ERROR
- FAILURE
- Use Parent Handlers
- Whether the logger should send its output to its parent logger. The default behavior is
true
.
- Changes take effect immediately.
18.2. Transaction Administration
18.2.1. Browse and Manage Transactions
log-store
. An API operation called probe
reads the transaction logs and creates a node for each log. You can call the probe
command manually, whenever you need to refresh the log-store
. It is normal for transaction logs to appear and disappear quickly.
Example 18.1. Refresh the Log Store
default
in a managed domain. For a standalone server, remove the profile=default
from the command.
/profile=default/subsystem=transactions/log-store=log-store/:probe
Example 18.2. View All Prepared Transactions
ls
command.
ls /profile=default/subsystem=transactions/log-store=log-store/transactions
Manage a Transaction
- View a transaction's attributes.
- To view information about a transaction, such as its JNDI name, EIS product name and version, or its status, use the
:read-resource
CLI command./profile=default/subsystem=transactions/log-store=log-store/transactions=0\:ffff7f000001\:-b66efc2\:4f9e6f8f\:9:read-resource
- View the participants of a transaction.
- Each transaction log contains a child element called
participants
. Use theread-resource
CLI command on this element to see the participants of the transaction. Participants are identified by their JNDI names./profile=default/subsystem=transactions/log-store=log-store/transactions=0\:ffff7f000001\:-b66efc2\:4f9e6f8f\:9/participants=java\:\/JmsXA:read-resource
The result may look similar to this:{ "outcome" => "success", "result" => { "eis-product-name" => "HornetQ", "eis-product-version" => "2.0", "jndi-name" => "java:/JmsXA", "status" => "HEURISTIC", "type" => "/StateManager/AbstractRecord/XAResourceRecord" } }
The outcome status shown here is in aHEURISTIC
state and is eligible for recover. Refer to Recover a transaction. for more details. - Delete a transaction.
- Each transaction log supports a
:delete
operation, to delete the transaction log representing the transaction./profile=default/subsystem=transactions/log-store=log-store/transactions=0\:ffff7f000001\:-b66efc2\:4f9e6f8f\:9:delete
- Recover a transaction.
- Each transaction log supports recovery via the
:recover
CLI command.Recovery of Heuristic Transactions and Participants
- If the transaction's status is
HEURISTIC
, the recovery operation changes the state toPREPARE
and triggers a recovery. - If one of the transaction's participants is heuristic, the recovery operation tries to replay the
commit
operation. If successful, the participant is removed from the transaction log. You can verify this by re-running the:probe
operation on thelog-store
and checking that the participant is no longer listed. If this is the last participant, the transaction is also deleted.
- Refresh the status of a transaction which needs recovery.
- If a transaction needs recovery, you can use the
:refresh
CLI command to be sure it still requires recovery, before attempting the recovery./profile=default/subsystem=transactions/log-store=log-store/transactions=0\:ffff7f000001\:-b66efc2\:4f9e6f8f\:9:refresh
Note
use-hornetq-store
option to true
, in the Transaction Manager configuration. Refer to Section 18.1.2, “Configure the Transaction Manager” for information on configuring the Transaction Manager.
If Transaction Manager (TM) statistics are enabled, you can view statistics about the Transaction Manager and transaction subsystem. Refer to Section 18.1.2, “Configure the Transaction Manager” for information about how to enable TM statistics.
Table 18.4. Transaction Subsystem Statistics
Statistic | Description | CLI Command |
---|---|---|
Total |
The total number of transactions processed by the Transaction Manager on this server.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-transactions,include-defaults=true) |
Committed |
The number of committed transactions processed by the Transaction Manager on this server.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-committed-transactions,include-defaults=true) |
Aborted |
The number of aborted transactions processed by the Transaction Manager on this server.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-aborted-transactions,include-defaults=true) |
Timed Out |
The number of timed out transactions processed by the Transaction Manager on this server.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-timed-out-transactions,include-defaults=true) |
Heuristics |
Not available in the Management Console. Number of transactions in a heuristic state.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-heuristics,include-defaults=true) |
In-Flight Transactions |
Not available in the Management Console. Number of transactions which have begun but not yet terminated.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-inflight-transactions,include-defaults=true) |
Failure Origin - Applications |
The number of failed transactions whose failure origin was an application.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-application-rollbacks,include-defaults=true) |
Failure Origin - Resources |
The number of failed transactions whose failure origin was a resource.
|
/host=master/server=server-one/subsystem=transactions/:read-attribute(name=number-of-resource-rollbacks,include-defaults=true) |
18.3. Transaction References
18.3.1. JBoss Transactions Errors and Exceptions
UserTransaction
class, see the UserTransaction API specification at http://download.oracle.com/javaee/1.3/api/javax/transaction/UserTransaction.html.
18.3.2. JTA Clustering Limitations
18.4. ORB Configuration
18.4.1. About Common Object Request Broker Architecture (CORBA)
18.4.2. Configure the ORB for JTS Transactions
Note
full
and full-ha
profiles only. In a standalone server, it is available when you use the standalone-full.xml
or standalone-full-ha.xml
configurations.
Procedure 18.3. Configure the ORB using the Management Console
View the profile settings.
Select Profiles (managed domain) or Profile (standalone server) from the top right of the management console. If you use a managed domain, select either the full or full-ha profile from the selection box at the top left.Modify the Initializers Settings
Expand the Subsystems menu at the left, if necessary. Expand the Container sub-menu and click JacORB.In the form that appears in the main screen, select the Initializers tab and click the Edit button.Enable the security interceptors by setting the value of Security toon
.To enable the ORB for JTS, set the Transaction Interceptors value toon
, rather than the defaultspec
.Refer to the Need Help? link in the form for detailed explanations about these values. Click Save when you have finished editing the values.Advanced ORB Configuration
Refer to the other sections of the form for advanced configuration options. Each section includes a Need Help? link with detailed information about the parameters.
You can configure each aspect of the ORB using the Management CLI. The following commands configure the initializers to the same values as the procedure above, for the Management Console. This is the minimum configuration for the ORB to be used with JTS.
/profile=full
portion of the commands.
Example 18.3. Enable the Security Interceptors
/profile=full/subsystem=jacorb/:write-attribute(name=security,value=on)
Example 18.4. Enable the ORB for JTS
/profile=full/subsystem=jacorb/:write-attribute(name=transactions,value=on)
Example 18.5. Enable Transactions in the JacORB Subsystem
/profile=full/subsystem=jacorb/:write-attribute(name=transactions,value=on)
Example 18.6. Enable JTS in the Transaction Subsystem
/subsystem=transactions:write-attribute(name=jts,value=true)
Chapter 19. Enterprise JavaBeans
19.1. Introduction
19.1.1. Overview of Enterprise JavaBeans
19.1.2. Overview of Enterprise JavaBeans for Administrators
- Clicking on the Profile link on the top right to switch to the Profile view.
- Expand the Profile menu on the left by clicking the arrow next to the label.
- Click on Container to expand it, and then click on EJB 3.
- Click on the Profile link on the top to switch to the Profile view.
- Expand the Subsystems menu on the left by clicking the arrow next to the label.
- Select the profile you are modifying from the Profile menu.
- Click on Container to expand it, and then click on EJB 3.
Figure 19.1. EJB Configuration Options in the Management Console (Standalone Server)
19.1.3. Enterprise Beans
Important
19.1.4. Session Beans
19.1.5. Message-Driven Beans
19.2. Configuring Bean Pools
19.2.1. Bean Pools
19.2.2. Create a Bean Pool
Procedure 19.1. Create a bean pool using the Management Console
- Login to the Management Console. Refer to Section 3.4.2, “Log in to the Management Console”.
- Navigate to the EJB3 Bean Pools panel.
Figure 19.2. EJB3 Bean Pools Panel
- Click the Add button. The Add EJB3 Bean Pools dialog appears.
- Specify the required details, Name, Max Pool Size, Timeout value, and Timeout unit.
- Click on the Save button to save the new bean pool or click the Cancel link to abort the procedure.
- If you click the Save button, the dialog will close and the new bean pool will appear in the list.
- If you click Cancel, the dialog will close and no new bean pool will be created.
Procedure 19.2. Create a bean pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
add
operation with the following syntax./subsystem=ejb3/strict-max-bean-instance-pool=BEANPOOLNAME:add(max-pool-size=MAXSIZE, timeout=TIMEOUT, timeout-unit="UNIT")
- Replace BEANPOOLNAME with the required name for the bean pool.
- Replace MAXSIZE with the maximum size of the bean pool.
- Replace TIMEOUT
- Replace UNIT with the required time unit. Allowed values are:
NANOSECONDS
,MICROSECONDS
,MILLISECONDS
,SECONDS
,MINUTES
,HOURS
, andDAYS
.
- Use the
read-resource
operation to confirm the creation of the bean pool./subsystem=ejb3/strict-max-bean-instance-pool=BEANPOOLNAME:read-resource
Example 19.1. Create a Bean Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/strict-max-bean-instance-pool=ACCTS_BEAN_POOL:add(max-pool-size=500, timeout=5000, timeout-unit="SECONDS") {"outcome" => "success"} [standalone@localhost:9999 /]
Example 19.2. XML Configuration Sample
<subsystem xmlns="urn:jboss:domain:ejb3:1.2"> <pools> <bean-instance-pools> <strict-max-pool name="slsb-strict-max-pool" max-pool-size="20" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES" /> <strict-max-pool name="mdb-strict-max-pool" max-pool-size="20" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES" /> </bean-instance-pools> </pools> </subsystem>
19.2.3. Remove a Bean Pool
Prerequisites:
- The bean pool that you want to remove cannot be in use. Refer to Section 19.2.5, “Assign Bean Pools for Session and Message-Driven Beans” to ensure that it is not being used.
Procedure 19.3. Remove a bean pool using the Management Console
- Login to the Management Console. Refer to Section 3.4.2, “Log in to the Management Console”.
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Bean Pools tab from the main panel.
Figure 19.3. EJB3 Bean Pools Panel
- Select the bean pool to remove in the list.
- Click the Remove button. The Remove Item dialog appears.
- Click the OK button to confirm deletion or click the Cancel link to abort the operation.If you click the Ok button, the dialog will close and the bean pool will be deleted and removed from the list.If you click Cancel, the dialog will close and no changes will be made.
Procedure 19.4. Remove a bean pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
remove
operation with the following syntax./subsystem=ejb3/strict-max-bean-instance-pool=BEANPOOLNAME:remove
- Replace BEANPOOLNAME with the required name for the bean pool.
Example 19.3. Removing a Bean Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/strict-max-bean-instance-pool=ACCTS_BEAN_POOL:remove {"outcome" => "success"} [standalone@localhost:9999 /]
19.2.4. Edit a Bean Pool
Procedure 19.5. Edit a bean pool using the Management Console
- Login to the Management Console. Section 3.4.2, “Log in to the Management Console”
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Bean Pools tab from the main panel.
Figure 19.4. EJB3 Bean Pools Panel
- Click on the bean pool you wish to edit from the list.
- Click the Edit button. The fields in the Details area are now editable.
- Edit the details you want to change. Only Max Pool Size, Timeout value, and Timeout unit can be changed.
- Click the Save button if you are satisfied with the changes, or click the Cancel link if you want to discard the changes.If you click the Ok button, the Details area will change back to it's non-editable form and the bean pool will be updated with the new details.If you click the Cancel link, the Details area will change back to it's non-editable form and no changes will be made.
Procedure 19.6. Edit a bean pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
write_attribute
operation with the following syntax for each attribute of the bean pool to be changed./subsystem=ejb3/strict-max-bean-instance-pool=BEANPOOLNAME:write-attribute(name="ATTRIBUTE", value="VALUE")
- Replace BEANPOOLNAME with the required name for the bean pool.
- Replace ATTRIBUTE with the name of the attribute to be edited. The attributes that can be edited in this way are
max-pool-size
,timeout
, andtimeout-unit
. - Replace VALUE with the required value of the attribute.
- Use the
read-resource
operation to confirm the changes to the bean pool./subsystem=ejb3/strict-max-bean-instance-pool=BEANPOOLNAME:read-resource
Example 19.4. Set the Timeout Value of a Bean Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/strict-max-bean-instance-pool=HSBeanPool:write-attribute(name="timeout", value="1500") {"outcome" => "success"} [standalone@localhost:9999 /]
19.2.5. Assign Bean Pools for Session and Message-Driven Beans
slsb-strict-max-pool
and mdb-strict-max-pool
for stateless session beans and message-driven beans respectively.
Procedure 19.7. Assign Bean Pools for Session and Message-Driven Beans using the Management Console
- Login to the Management Console. Section 3.4.2, “Log in to the Management Console”
- Navigate to the EJB3 Container Configuration panel.
Figure 19.5. EJB3 Container Configuration panel in the Management Console (Standalone Server)
- Click the Edit button. The fields in the Details area are now editable.
- Select the bean pool to use for each type of bean from the appropriate combo-box.
- Click the Save button to keep the changes, or click the Cancel link to discard them.
- The Details area will now be non-editable and display the correct bean pool selection.
Procedure 19.8. Assign Bean Pools for Session and Message-Driven Beans using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
write-attribute
operation with the following syntax./subsystem=ejb3:write-attribute(name="BEANTYPE", value="BEANPOOL")
- Replace BEANTYPE with
default-mdb-instance-pool
for Message-Driven Beans ordefault-slsb-instance-pool
for stateless session beans. - Replace BEANPOOL with the name of the bean pool to assign.
- Use the
read-resource
operation to confirm the changes./subsystem=ejb3:read-resource
Example 19.5. Assign a Bean Pool for Session Beans using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3:write-attribute(name="default-slsb-instance-pool", value="LV_SLSB_POOL") {"outcome" => "success"} [standalone@localhost:9999 /]
Example 19.6. XML Configuration Sample
<subsystem xmlns="urn:jboss:domain:ejb3:1.2"> <session-bean> <stateless> <bean-instance-pool-ref pool-name="slsb-strict-max-pool"/> </stateless> <stateful default-access-timeout="5000" cache-ref="simple"/> <singleton default-access-timeout="5000"/> </session-bean> <mdb> <resource-adapter-ref resource-adapter-name="hornetq-ra"/> <bean-instance-pool-ref pool-name="mdb-strict-max-pool"/> </mdb> </subsystem>
19.3. Configuring EJB Thread Pools
19.3.1. Enterprise Bean Thread Pools
19.3.2. Create a Thread Pool
Procedure 19.9. Create an EJB Thread Pool using the Management Console
- Login to the Management Console. Section 3.4.2, “Log in to the Management Console”
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Thread Pools tab from the main panel.
Figure 19.6. EJB3 Thread Pools Panel
- Click the Add button. The Add EJB3 Thread Pools dialog appears.
- Specify the required details, Name, Max. Threads, and Keep-Alive Timeout value.
- Click on the Save button to save the new thread pool or click the Cancel link to abort the procedure.
- If you click the Save button, the dialog will close and the new thread pool will appear in the list.
- If you click Cancel, the dialog will close and no new thread pool will be created.
Procedure 19.10. Create a Thread Pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
add
operation with the following syntax./subsystem=ejb3/thread-pool=THREADPOOLNAME:add(max-threads=MAXSIZE, keepalive-time={"time"=>"TIME", "unit"=>UNIT"})
- Replace THREADPOOLNAME with the required name for the thread pool.
- Replace MAXSIZE with the maximum size of the thread pool.
- Replace UNIT with the required time unit to be used for the required keep-alive time. Allowed values are:
NANOSECONDS
,MICROSECONDS
,MILLISECONDS
,SECONDS
,MINUTES
,HOURS
, andDAYS
. - Replace TIME with the integer value of the required keep-alive time. This value is a number of UNITs.
- Use the
read-resource
operation to confirm the creation of the bean pool./subsystem=ejb3/strict-max-bean-instance-pool=THREADPOOLNAME:read-resource
Example 19.7. Create a Thread Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/thread-pool=testmepool:add(max-threads=50, keepalive-time={"time"=>"150", "unit"=>"SECONDS"}) {"outcome" => "success"} [standalone@localhost:9999 /]
Example 19.8. XML Configuration Sample
<subsystem xmlns="urn:jboss:domain:ejb3:1.2"> <thread-pools> <thread-pool name="default" max-threads="20" keepalive-time="150"/> </thread-pools> </subsystem>
19.3.3. Remove a Thread Pool
Prerequisites
- The thread pool that you want to remove cannot be in use. Refer to the following tasks to ensure that the thread pool is not in use:
Procedure 19.11. Remove an EJB thread pool using the Management Console
- Login to the Management Console. Section 3.4.2, “Log in to the Management Console”.
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Thread Pools tab from the main panel.
Figure 19.7. EJB3 Thread Pools Panel
- Select the thread pool to remove in the list.
- Click the Remove button. The Remove Item dialog appears.
- Click the OK button to confirm deletion or click the Cancel link to abort the operation.If you click the Ok button, the dialog will close and the thread pool will be deleted and removed from the list.If you click Cancel, the dialog will close and no changes will be made.
Procedure 19.12. Remove a thread pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
remove
operation with the following syntax./subsystem=ejb3/thread-pool=THREADPOOLNAME:remove
- Replace THREADPOOLNAME with the name of the thread pool.
Example 19.9. Removing a Thread Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/thread-pool=ACCTS_THREADS:remove {"outcome" => "success"} [standalone@localhost:9999 /]
19.3.4. Edit a Thread Pool
Procedure 19.13. Edit a Thread Pool using the Management Console
Login
Login to the Management Console.Navigate to the EJB3 Thread Pools Tab
Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Thread Pools tab from the main panel.Figure 19.8. EJB3 Thread Pools Tab
Select the Thread Pool to Edit
Select the thread pool you wish to edit from the list.Click the Edit button
The fields in the Details area are now editable.Edit Details
Edit the details you want to change. Only theThread Factory
,Max Threads
,Keepalive Timeout
, andKeepalive Timeout Unit
values can be edited.Save or Cancel
Click the Save button if you are satisfied with the changes, or click the Cancel link if you want to discard the changes.
Procedure 19.14. Edit a thread pool using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
write_attribute
operation with the following syntax for each attribute of the thread pool to be changed./subsystem=ejb3/thread-pool=THREADPOOLNAME:write-attribute(name="ATTRIBUTE", value="VALUE")
- Replace THREADPOOLNAME with the name of the thread pool.
- Replace ATTRIBUTE with the name of the attribute to be edited. The attributes that can be edited in this way are
keepalive-time
,max-threads
, andthread-factory
. - Replace VALUE with the required value of the attribute.
- Use the
read-resource
operation to confirm the changes to the thread pool./subsystem=ejb3/thread-pool=THREADPOOLNAME:read-resource
Important
keepalive-time
attribute with the CLI the required value is an object representation. It has the following syntax.
/subsystem=ejb3/thread-pool=THREADPOOLNAME:write-attribute(name="keepalive-time", value={"time" => "VALUE","unit" => "UNIT"}
Example 19.10. Set the Maxsize Value of a Thread Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/thread-pool=HSThreads:write-attribute(name="max-threads", value="50") {"outcome" => "success"} [standalone@localhost:9999 /]
Example 19.11. Set the keepalive-time
Time Value of a Thread Pool using the CLI
[standalone@localhost:9999 /] /subsystem=ejb3/thread-pool=HSThreads:write-attribute(name="keepalive-time", value={"time"=>"150"}) {"outcome" => "success"} [standalone@localhost:9999 /]
19.4. Configuring Session Beans
19.4.1. Session Bean Access Timeout
@javax.ejb.AccessTimeout
annotation on the method. It can be specified on the session bean (which applies to all the bean's methods) and on specific methods to override the configuration for the bean.
19.4.2. Set Default Session Bean Access Timeout Values
Procedure 19.15. Set Default Session Bean Access Timeout Values using the Management Console
- Login to the Management Console. See Section 3.4.2, “Log in to the Management Console”.
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Container tab from the main panel.
Figure 19.9. EJB3 Container Configuration panel in the Management Console (Standalone Server)
- Click the Edit button. The fields in the Details area are now editable.
- Enter the required values in the Stateful Access Timeout and/or Singleton Access Timeout text boxes.
- Click the Save button to keep the changes, or click the Cancel link to discard them.
- The Details area will now be non-editable and display the correct timeout values.
Procedure 19.16. Set Session Bean Access Timeout Values Using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
write-attribute
operation with the following syntax./subsystem=ejb3:write-attribute(name="BEANTYPE", value=TIME)
- Replace BEANTYPE with
default-stateful-bean-access-timeout
for Stateful Session Beans, ordefault-singleton-bean-access-timeout
for Singleton Session Beans. - Replace TIME with the required timeout value.
- Use the
read-resource
operation to confirm the changes./subsystem=ejb3:read-resource
Example 19.12. Setting the Default Stateful Bean Access Timeout value to 9000 with the CLI
[standalone@localhost:9999 /] /subsystem=ejb3:write-attribute(name="default-stateful-bean-access-timeout", value=9000) {"outcome" => "success"} [standalone@localhost:9999 /]
Example 19.13. XML Configuration Sample
<subsystem xmlns="urn:jboss:domain:ejb3:1.2"> <session-bean> <stateless> <bean-instance-pool-ref pool-name="slsb-strict-max-pool"/> </stateless> <stateful default-access-timeout="5000" cache-ref="simple"/> <singleton default-access-timeout="5000"/> </session-bean> </subsystem>
19.5. Configuring Message-Driven Beans
19.5.1. Set Default Resource Adapter for Message-Driven Beans
hornetq-ra
.
Procedure 19.17. Set the Default Resource Adapter for Message-Driven Beans using the Management Console
- Login to the Management Console. Section 3.4.2, “Log in to the Management Console”
- Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Then select the Container tab from the main panel.
Figure 19.10. EJB3 Container Configuration panel in the Management Console (Standalone Server)
- Click the Edit button. The fields in the Details area are now editable.
- Enter the name of the resource adapter to be used in the Default Resource Adapter text box.
- Click the Save button to keep the changes, or click the Cancel link to discard them.
- The Details area will now be non-editable and display the correct resource adapter name.
Procedure 19.18. Set the Default Resource Adapter for Message-Driven Beans using the CLI
- Launch the CLI tool and connect to your server. Refer to Section 3.5.4, “Connect to a Managed Server Instance Using the Management CLI”.
- Use the
write-attribute
operation with the following syntax./subsystem=ejb3:write-attribute(name="default-resource-adapter-name", value="RESOURCE-ADAPTER")
Replace RESOURCE-ADAPTER with name of the resource adapter to be used. - Use the
read-resource
operation to confirm the changes./subsystem=ejb3:read-resource
Example 19.14. Set the Default Resource Adapter for Message-Driven Beans using the CLI
[standalone@localhost:9999 subsystem=ejb3] /subsystem=ejb3:write-attribute(name="default-resource-adapter-name", value="EDIS-RA") {"outcome" => "success"} [standalone@localhost:9999 subsystem=ejb3]
Example 19.15. XML Configuration Sample
<subsystem xmlns="urn:jboss:domain:ejb3:1.2"> <mdb> <resource-adapter-ref resource-adapter-name="hornetq-ra"/> <bean-instance-pool-ref pool-name="mdb-strict-max-pool"/> </mdb> </subsystem>
19.6. Configuring the EJB3 Timer Service
19.6.1. EJB3 Timer Service
19.6.2. Configure the EJB3 timer Service
Procedure 19.19. Configure the EJB3 Timer Service
Login
Login to the Management Console.Open the Timer Service Tab
Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Select the Services tab from the main panel and then the Timer Service tab.Figure 19.11. Timer Service tab of the EJB3 Services panel
Enter Edit Mode
Click the Edit Button. The fields become editable.Make the Required Changes.
You can select a different EJB3 thread pool used for the Timer Service if additional thread pools have been configured, and you can change the directory used to save the Timer Service data. The Timer Service data directory configuration consists of two values:Path
, the directory that data is stored in; andRelative To
, the directory which containsPath
. By defaultRelative To
is set to a Filesystem Path Variable.Save or Cancel
Click the Save button to keep the changes, or click the Cancel link to discard them.
19.7. Configuring the EJB Asynchronous Invocation Service
19.7.1. EJB3 Asynchronous Invocation Service
19.7.2. Configure the EJB3 Asynchronous Invocation Service Thread Pool
Procedure 19.20. Configure the EJB3 Asynchronous Invocation Service thread pool
Login
Login to the Management Console.Open the Async Service tab
Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Select the Services tab from the main panel and then the Async Service tab.Figure 19.12. The Async Service tab of the EJB3 Services panel
Enter Edit Mode
Click the Edit Button. The fields become editable.Select the thread pool
Select the EJB3 thread pool to use from the list. The thread pool must have been already created.Save or Cancel
Click the Save button to keep the changes, or click the Cancel link to discard them.
19.8. Configuring the EJB3 Remote Invocation Service
19.8.1. EJB3 Remote Service
19.8.2. Configure the EJB3 Remote Service
Procedure 19.21. Configure the EJB3 Remote Service
Login
Login to the Management Console.Open the Remote Service tab
Click on Profile in the top right, expand the Container item in the Profile panel on the left and select EJB 3. Select the Services tab from the main panel, and then the Remote Service tab.Figure 19.13. The Remote Service tab of the EJB3 Services panel
Enter Edit Mode
Click the Edit Button. The fields become editable.Make the required changes
You can select a different EJB3 thread pool used for the Remote Service if additional thread pools have been configured. You can change the connector used to register the EJB remoting channel.Save or Cancel
Click the Save button to keep the changes, or click the Cancel link to discard them.
19.9. Configuring EJB 2.x Entity Beans
19.9.1. EJB Entity Beans
19.9.2. Container-Managed Persistence
19.9.3. Enable EJB 2.x Container-Managed Persistence
org.jboss.as.cmp
extension. CMP is enabled by default in the managed domain and standalone server full configurations, e.g. standalone-full.xml
.
org.jboss.as.cmp
module to the list of enabled extensions in the server configuration file.
<extensions> <extension module="org.jboss.as.cmp"/> </extensions>
org.jboss.as.cmp
module.
19.9.4. Configure EJB 2.x Container-Managed Persistence
- UUID-based key generators
- A UUID-based key generator creates keys using Universally Unique Identifiers. UUID key generators only need to have a unique name, they have no other configuration.UUID-based key generators can be added using the CLI using the following command syntax.
/subsystem=cmp/uuid-keygenerator=UNIQUE_NAME:add
Example 19.16. Add UUID Key Generator
To add a UUID-based key generator with the name ofuuid_identities
, use this CLI command:/subsystem=cmp/uuid-keygenerator=uuid_identities:add
The XML configuration created by this command is:<subsystem xmlns="urn:jboss:domain:cmp:1.0"> <key-generators> <uuid name="uuid_identities" /> </key-generators> </subsystem>
- HiLo Key Generators
- HiLo key generators use a database to create and store entity identity keys. HiLo Key generators must have unique names and are configured with properties that specify the datasource used to store the data as well as the names of the table and columns that store the keys.HiLo key generators can be added using the CLI using the following command syntax:
/subsystem=cmp/hilo-keygenerator=UNIQUE_NAME/:add(property=value, property=value, ...)
Example 19.17. Add a HiLo Key Generator
/subsystem=cmp/hilo-keygenerator=DB_KEYS/:add(create-table=false,data-source=java:jboss/datasources/ExampleDS,drop-table=false,id-column=cmp_key_ids,select-hi-ddl=select max(cmp_key_ids) from cmp_key_seq,sequence-column=cmp_key_seq,table-name=cmp-keys))
The XML configuration created by this command is:<subsystem xmlns="urn:jboss:domain:cmp:1.0"> <key-generators> <hilo name="DB_KEYS"> <create-table>false</create-table> <data-source>java:jboss/datasources/ExampleDS</data-source> <drop-table>false</drop-table> <id-column>cmp_key_ids</id-column> <select-hi-ddl>select max(cmp_key_ids) from cmp_key_seq</select-hi-ddl> <sequence-column>cmp_key_seq</sequence-column> <table-name>cmp-keys</table-name> </hilo> </key-generators> </subsystem>
19.9.5. CMP Subsystem Properties for HiLo Key Generators
Table 19.1. CMP Subsystem Properties for HiLo Key Generators
Property | Data type | Description |
---|---|---|
block-size | long |
-
|
create-table | boolean |
If set to
TRUE , a table called table-name will be created using the contents of create-table-ddl if that table is not found.
|
create-table-ddl | string |
The DDL commands used to create the table specified in
table-name if the table is not found and create-table is set to TRUE .
|
data-source | token |
The data source used to connect to the database.
|
drop-table | boolean |
-
|
id-column | token |
-
|
select-hi-ddl | string | The SQL command which will return the largest key currently stored. |
sequence-column | token |
-
|
sequence-name | token |
-
|
table-name | token |
The name of the table used to store the key information.
|
Chapter 20. Java Connector Architecture (JCA)
20.1. Introduction
20.1.1. About the Java EE Connector API (JCA)
20.1.2. Java Connector Architecture (JCA)
- connections
- transactions
- security
- life-cycle
- work instances
- transaction inflow
- message inflow
20.1.3. Resource Adapters
20.2. Configure the Java Connector Architecture (JCA) Subsystem
- Archive validation
- This setting whether archive validation will be performed on the deployment units.
- The following table describes the attributes you can set for archive validation.
Table 20.1. Archive validation attributes
Attribute Default Value Description enabled
true Specifies whether archive validation is enabled.fail-on-error
true Specifies whether an archive validation error report fails the deployment.fail-on-warn
false Specifies whether an archive validation warning report fails the deployment. - If an archive does not implement the Java EE Connector Architecture specification correctly and archive validation is enabled, an error message will display during deployment describing the problem. For example:
Severity: ERROR Section: 19.4.2 Description: A ResourceAdapter must implement a "public int hashCode()" method. Code: com.mycompany.myproject.ResourceAdapterImpl Severity: ERROR Section: 19.4.2 Description: A ResourceAdapter must implement a "public boolean equals(Object)" method. Code: com.mycompany.myproject.ResourceAdapterImpl
- If archive validation is not specifed, it is considered present and the
enabled
attribute defaults to true.
- Bean validation
- This setting determines whether bean validation (JSR-303) will be performed on the deployment units.
- The following table describes the attributes you can set for bean validation.
Table 20.2. Bean validation attributes
Attribute Default Value Description enabled
true Specifies whether bean validation is enabled. - If bean validation is not specifed, it is considered present and the
enabled
attribute defaults to true.
- Work managers
- There are two types of work managers:
- Default work manager
- The default work manager and its thread pools.
- Custom work manager
- A custom work manager definition and its thread pools.
- The following table describes the attributes you can set for work managers.
Table 20.3. Work manager attributes
Attribute Description name
Specifies the name of the work manager. This is required for custom work managers.short-running-threads
Thread pool for standard Work instances. Each work manager has one short-running thread pool.long-running-threads
Thread pool for JCA 1.6 Work instances that set theLONG_RUNNING
hint. Each work manager can have one optional long-running thread pool. - The following table describes the attributes you can set for work manager thread pools.
Table 20.4. Thread pool attributes
Attribute Description allow-core-timeout
Boolean setting that determines whether core threads may time out. The default value is false.core-threads
The core thread pool size. This must be smaller than the maximum thread pool size.queue-length
The maximum queue length.max-thread
The maximum thread pool size.keepalive-time
Specifies the amount of time that pool threads should be kept after doing work.thread-factory
Reference to the thread factory .
- Bootstrap contexts
- Used to define custom bootstrap contexts.
- The following table describes the attributes you can set for bootstrap contexts.
Table 20.5. Bootstrap context attributes
Attribute Description name
Specifies the name of the bootstrap context.workmanager
Specifies the name of the work manager to use for this context.
- Cached connection manager
- Used for debugging connections and supporting lazy enlistment of a connection in a transaction, tracking whether they are used and released properly by the application.
- The following table describes the attributes you can set for the cached connection manager.
Table 20.6. Cached connection manager attributes
Attribute Default Value Description debug
false Outputs warning on failure to explicity close connections.error
false Throws exception on failure to explicitly close connections.
Procedure 20.1. Configure the JCA subsystem using the Management Console
- The JCA subsystem of JBoss EAP 6 can be configured in the Management Console. The JCA configuration options are located in slightly different places in the Management Console depending on how the server is being run.
- If the server is running as a Standalone Server, follow these steps:
- Click on the Profile link on the top right to switch to the Profile view.
- Ensure the Profile section in the navigation panel to the left is expanded.
- Click on Connector to expand it, and then click on JCA.
- If the server is running as part of a Managed Domain, follow these steps:
- Click on the Profile link on the top right to switch to the Profile view
- Select the profile you are modifying from the Profile menu at the top of the navigation panel on the left.
- Click on Connector to expand it, and then click on JCA.
- Configure the settings for the JCA subsystem using the three tabs.
Common Config
The Common Config tab contains settings for the cached connection manager, archive validation and bean validation (JSR-303). Each of these is contained in their own tab as well. These settings can be changed by opening the appropriate tab, clicking the edit button, making the required changes, and then clicking on the save button.Figure 20.1. JCA Common Configuration
Work Managers
The Work Manager tab contains the list of configured Work Managers. New Work Managers can be added, removed, and their thread pools configured here. Each Work Manager can have one short-running thread pool and an optional long-running thread pool.Figure 20.2. Work Managers
The thread pool attributes can be configured here:Figure 20.3. Work Manager Thread Pools
Bootstrap Contexts
The Bootstrap Contexts tab contains the list of configured Bootstrap Contexts. New Bootstrap Context objects can be added, removed, and configured. Each Bootstrap Context must be assigned a Work Manager.Figure 20.4. Bootstrap Contexts
20.3. Deploy a Resource Adapter
Procedure 20.2. Deploy a resource adapter using the Management CLI
- Open a command prompt for your operating system.
- Connect to the Management CLI.
- For Linux, enter the following at the command line:
$ EAP_HOME/bin/jboss-cli.sh --connect $ Connected to standalone controller at localhost:9999
- For Windows, enter the following at a command line:
C:\>EAP_HOME\bin\jboss-cli.bat --connect C:\> Connected to standalone controller at localhost:9999
- Deploy the resource adapter.
- To deploy the resource adapter to a standalone server, enter the following at a command line:
$ deploy path/to/resource-adapter-name.rar
- To deploy the resource adapter to all server groups in a managed domain, enter the following at a command line:
$ deploy path/to/resource-adapter-name.rar --all-server-groups
Procedure 20.3. Deploy a resource adapter using the Web-based Management Console
- Start your JBoss EAP 6 server.
- If you have not yet added a management user, add one now. For more information, refer to the Getting Started chapter of the Installation guide for JBoss EAP 6. Section 4.1.1, “Add the Initial User for the Management Interfaces”
- Open a web browser and navigate to the Management Console. The default location is http://localhost:9990/console/. For more information about the Management Console, see Section 3.4.2, “Log in to the Management Console”.
- Click on the Runtime link on the top right to switch to the Runtime view, then choose Manage Deployments in the left navigation panel, and click Add Content at the top right.
- Browse to the resource adapter archive and select it. Then click Next.
- Verify the deployment names, then click Save.
- The resource adapter archive should now appear in the list in a disabled state. Click the Enable link to enable it.
- A dialog asks "Are you sure?" you want to enable the listed RAR. Click Confirm. The resource adapter archive should now appear as
Enabled
.
Procedure 20.4. Deploy a resource adapter manually
- Copy the resource adapter archive to the server deployments directory,
- For a standalone server, copy the resource adapter archive to the
EAP_HOME/standalone/deployments/
directory. - For a managed domain, you must use the Management Console or Managment CLI to deploy the resource adapter archive to the server groups.
20.4. Configure a Deployed Resource Adapter
Note
[standalone@localhost:9999 /]
prompt. Do NOT type the text withing the curly braces. That is the output you should see as a result of the command, for example, {"outcome" => "success"}
.
Procedure 20.5. Configure a resource adapter using the Management CLI
- Open a command prompt for your operating system.
- Connect to the Management CLI.
- For Linux, enter the following at the command line:
$ EAP_HOME/bin/jboss-cli.sh --connect
You should see the following result output:$ Connected to standalone controller at localhost:9999
- For Windows, enter the following at a command line:
C:\>EAP_HOME\bin\jboss-cli.bat --connect
You should see the following result output:C:\> Connected to standalone controller at localhost:9999
- Add the resource adapter configuration.
[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar:add(archive=eis.rar, transaction-support=XATransaction) {"outcome" => "success"}
- Configure the
server
resource adapter level <config-property>.[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/config-properties=server/:add(value=localhost) {"outcome" => "success"}
- Configure the
port
resource adapter level <config-property>.[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/config-properties=port/:add(value=9000) {"outcome" => "success"}
- Add a connection definition for a managed connection factory.
[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/connection-definitions=cfName:add(class-name=com.acme.eis.ra.EISManagedConnectionFactory, jndi-name=java:/eis/AcmeConnectionFactory) {"outcome" => "success"}
- Configure the
name
managed connection factory level <config-property>.[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/connection-definitions=cfName/config-properties=name/:add(value=Acme Inc) {"outcome" => "success"}
- Add an admin object.
[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/admin-objects=aoName:add(class-name=com.acme.eis.ra.EISAdminObjectImpl, jndi-name=java:/eis/AcmeAdminObject) {"outcome" => "success"}
- Configure the
threshold
admin object property.[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar/admin-objects=aoName/config-properties=threshold/:add(value=10) {"outcome" => "success"}
- Activate the resource adapter.
[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar:activate {"outcome" => "success"}
- View the newly configured and activated resource adapter.
[standalone@localhost:9999 /] /subsystem=resource-adapters/resource-adapter=eis.rar:read-resource(recursive=true) { "outcome" => "success", "result" => { "archive" => "eis.rar", "beanvalidationgroups" => undefined, "bootstrap-context" => undefined, "transaction-support" => "XATransaction", "admin-objects" => {"aoName" => { "class-name" => "com.acme.eis.ra.EISAdminObjectImpl", "enabled" => true, "jndi-name" => "java:/eis/AcmeAdminObject", "use-java-context" => true, "config-properties" => {"threshold" => {"value" => 10}} }}, "config-properties" => { "server" => {"value" => "localhost"}, "port" => {"value" => 9000} }, "connection-definitions" => {"cfName" => { "allocation-retry" => undefined, "allocation-retry-wait-millis" => undefined, "background-validation" => false, "background-validation-millis" => undefined, "blocking-timeout-wait-millis" => undefined, "class-name" => "com.acme.eis.ra.EISManagedConnectionFactory", "enabled" => true, "flush-strategy" => "FailingConnectionOnly", "idle-timeout-minutes" => undefined, "interleaving" => false, "jndi-name" => "java:/eis/AcmeConnectionFactory", "max-pool-size" => 20, "min-pool-size" => 0, "no-recovery" => undefined, "no-tx-separate-pool" => false, "pad-xid" => false, "pool-prefill" => false, "pool-use-strict-min" => false, "recovery-password" => undefined, "recovery-plugin-class-name" => undefined, "recovery-plugin-properties" => undefined, "recovery-security-domain" => undefined, "recovery-username" => undefined, "same-rm-override" => undefined, "security-application" => undefined, "security-domain" => undefined, "security-domain-and-application" => undefined, "use-ccm" => true, "use-fast-fail" => false, "use-java-context" => true, "use-try-lock" => undefined, "wrap-xa-resource" => true, "xa-resource-timeout" => undefined, "config-properties" => {"name" => {"value" => "Acme Inc"}} }} } }
Procedure 20.6. Configure a resource adapter using the Web-based Management Console
- Start your JBoss EAP 6 server.
- If you have not yet added a management user, add one now. For more information, refer to the Getting Started chapter of the Installation guide for JBoss EAP 6.
- Open a web browser and navigate to the Management Console. The default location is http://localhost:9990/console/. For more information about the Management Console, see Section 3.4.2, “Log in to the Management Console”.
- Click on the Profile link on the top right to switch to the Profile view. Choose Resource Adapters in the left navigation panel, then click Add at the top right.
Figure 20.5. JCA Resource Adapters
- Enter the archive name and choose transaction type
XATransaction
from the TX: drop-down box. Then click Save.Figure 20.6. Create Resource Adapter
- Select the Properties tab, then click Add to add resource adapter properties.
Figure 20.7. Add Resource Adapter Properties
- Enter
server
for the Name and the host name, for examplelocalhost
, for the Value. Then click Save to save the property.Figure 20.8. Add Resource Adapter Server Property
- Enter
port
for the Name and the port number, for example9000
, for the Value. Then click Save to save the property.Figure 20.9. Add Resource Adapter Port Property
- The
server
andport
properties now appear in the Properties panel. Click the View link under the Option column for the listed resource adapter to view the Connection Definitions.Figure 20.10. Resource Adapter Server Properties Complete
- Click Add in the upper right side of the page to add a connection definition.
Figure 20.11. Add a Connection Definition
- Enter the JNDI Name and the fully qualified class name of the Connection Class. Then click Next.
Figure 20.12. Create Connection Definition Property - Step 1
- Click Add to enter the Key and Value data for this connection definition.
Figure 20.13. Create Connection Definition Property - Step 2
- Click in the
name
field under the Key column to enable data entry for the field. Type the property name and press enter when done. Click in thevalue
field under the Value column to enable data entry for the field. Enter the value for the property and press enter when done. Then click Save to save the property.Figure 20.14. Create Connection Definition Property - Step 2
- The connection definition is complete, but disabled. Click Enable to enable the connection definition.
Figure 20.15. Create Connection Definition - Disabled
- A dialog asks "Really modify Connection Definition?" for the JNDI name. Click Confirm. The connection definition should now appear as
Enabled
.Figure 20.16. Connection Definition Enabled
- Click the Admin Objects tab in top middle of the page to create and configure admin objects. Then click Add.
Figure 20.17. Available Admin Objects
- Enter the JNDI Name and the fully qualified Class Name for the admnin object. Then click Save.
Figure 20.18. Create Admin Object
- Select the Properties tab, then click Add to add admin object properties.
Figure 20.19. Add Admin Object Properties
- Enter an admin object configuration property, for example
threshold
, in the Name field. Enter the configuration property value, for example10
, in the Value field. Then click Save to save the property.Figure 20.20. Create Admin Ojbect Configuration Property
- The admin object is complete, but disabled. Click Enable to enable the admin object.
Figure 20.21. Admin Object - Disabled
- A dialog asks "Really modify Admin Ojbect?" for the JNDI name. Click Confirm. The admin object should now appear as
Enabled
.Figure 20.22. Connection Definition Enabled
- You must reload the server configuration to complete the process. Click on the Runtime link on the top right to switch to the Runtime view, then choose Configuration in the left navigation panel, and click Reload at the right.
Figure 20.23. Server Configuration Reload
- A dialog asks "Do you want to reload the server configuration?" for the specified server. Click Confirm. The server configuration is up to date.
Figure 20.24. Connection Definition Enabled
Procedure 20.7. Configure a resource adapter manually
- Stop the JBoss EAP 6 server.
Important
You must stop the server before editing the server configuration file for your change to be persisted on server restart. - Open the server configuration file for editing.
- For a standalone server, this is the
EAP_HOME/standalone/configuration/standalone.xml
file. - For a managed domain, this is the
EAP_HOME/domain/configuration/domain.xml
file.
- Find the
urn:jboss:domain:resource-adapters
subsystem in the configuration file. - If there are no resource adapters defined for this subsystem, first replace:
<subsystem xmlns="urn:jboss:domain:resource-adapters:1.1"/>
with this:<subsystem xmlns="urn:jboss:domain:resource-adapters:1.1"> <resource-adapters> <!-- <resource-adapter> configuration listed below --> </resource-adapters> </subsystem>
- Replace the
<!-- <resource-adapter> configuration listed below -->
with the XML definition for your resource adapter. The following is the XML representation of the resource adapter configuration created using the Management CLI and Web-based Management Console described above.<resource-adapter> <archive> eis.rar </archive> <transaction-support>XATransaction</transaction-support> <config-property name="server"> localhost </config-property> <config-property name="port"> 9000 </config-property> <connection-definitions> <connection-definition class-name="com.acme.eis.ra.EISManagedConnectionFactory" jndi-name="java:/eis/AcmeConnectionFactory" pool-name="java:/eis/AcmeConnectionFactory"> <config-property name="name"> Acme Inc </config-property> </connection-definition> </connection-definitions> <admin-objects> <admin-object class-name="com.acme.eis.ra.EISAdminObjectImpl" jndi-name="java:/eis/AcmeAdminObject" pool-name="java:/eis/AcmeAdminObject"> <config-property name="threshold"> 10 </config-property> </admin-object> </admin-objects> </resource-adapter>
Start the server
Relaunch the JBoss EAP 6 server to start it running with the new configuration.
20.5. Resource Adapter Descriptor Reference
Table 20.7. Main elements
Element | Description |
---|---|
bean-validation-groups | Specifies bean validation group that should be used |
bootstrap-context | Specifies the unique name of the bootstrap context that should be used |
config-property | The config-property specifies resource adapter configuration properties. |
transaction-support | Define the type of transaction supported by this resource adapter. Valid values are: NoTransaction, LocalTransaction, XATransaction |
connection-definitions | Specifies the connection definitions |
admin-objects | Specifies the administration objects |
Table 20.8. Bean validation groups elements
Element | Description |
---|---|
bean-validation-group | Specifies the fully qualified class name for a bean validation group that should be used for validation |
Table 20.9. Connection definition / admin object attributes
Attribute | Description |
---|---|
class-name | Specifies the fully qualified class name of a managed connection factory or admin object |
jndi-name | Specifies the JNDI name |
enabled | Should the object be activated |
use-java-context | Specifies if a java:/ JNDI context should be used |
pool-name | Specifies the pool name for the object |
use-ccm | Enable the cached connection manager |
Table 20.10. Connection definition elements
Element | Description |
---|---|
config-property | The config-property specifies managed connection factory configuration properties. |
pool | Specifies pooling settings |
xa-pool | Specifies XA pooling settings |
security | Specifies security settings |
timeout | Specifies time out settings |
validation | Specifies validation settings |
recovery | Specifies the XA recovery settings |
Table 20.11. Pool elements
Element | Description |
---|---|
min-pool-size | The min-pool-size element indicates the minimum number of connections a pool should hold. These are not created until a Subject is known from a request for a connection. This default to 0 |
max-pool-size | The max-pool-size element indicates the maximum number of connections for a pool. No more than max-pool-size connections will be created in each sub-pool. This defaults to 20. |
prefill | Whether to attempt to prefill the connection pool. Default is false |
use-strict-min | Specifies if the min-pool-size should be considered strictly. Default false |
flush-strategy | Specifies how the pool should be flush in case of an error. Valid values are: FailingConnectionOnly (default), IdleConnections, EntirePool |
Table 20.12. XA pool elements
Element | Description |
---|---|
min-pool-size | The min-pool-size element indicates the minimum number of connections a pool should hold. These are not created until a Subject is known from a request for a connection. This default to 0 |
max-pool-size | The max-pool-size element indicates the maximum number of connections for a pool. No more than max-pool-size connections will be created in each sub-pool. This defaults to 20. |
prefill | Whether to attempt to prefill the connection pool. Default is false |
use-strict-min | Specifies if the min-pool-size should be considered strictly. Default false |
flush-strategy | Specifies how the pool should be flush in case of an error. Valid values are: FailingConnectionOnly (default), IdleConnections, EntirePool |
is-same-rm-override | The is-same-rm-override element allows one to unconditionally set whether the javax.transaction.xa.XAResource.isSameRM(XAResource) returns true or false |
interleaving | An element to enable interleaving for XA connection factories |
no-tx-separate-pools | Oracle does not like XA connections getting used both inside and outside a JTA transaction. To workaround the problem you can create separate sub-pools for the different contexts |
pad-xid | Should the Xid be padded |
wrap-xa-resource | Should the XAResource instances be wrapped in a org.jboss.tm.XAResourceWrapper instance |
Table 20.13. Security elements
Element | Description |
---|---|
application | Indicates that application supplied parameters (such as from getConnection(user, pw)) are used to distinguish connections in the pool. |
security-domain | Indicates Subject (from security domain) are used to distinguish connections in the pool. The content of the security-domain is the name of the JAAS security manager that will handle authentication. This name correlates to the JAAS login-config.xml descriptor application-policy/name attribute. |
security-domain-and-application | Indicates that either application supplied parameters (such as from getConnection(user, pw)) or Subject (from security domain) are used to distinguish connections in the pool. The content of the security-domain is the name of the JAAS security manager that will handle authentication. This name correlates to the JAAS login-config.xml descriptor application-policy/name attribute. |
Table 20.14. Time out elements
Element | Description |
---|---|
blocking-timeout-millis | The blocking-timeout-millis element indicates the maximum time in milliseconds to block while waiting for a connection before throwing an exception. Note that this blocks only while waiting for a permit for a connection, and will never throw an exception if creating a new connection takes an inordinately long time. The default is 30000 (30 seconds). |
idle-timeout-minutes | The idle-timeout-minutes elements indicates the maximum time in minutes a connection may be idle before being closed. The actual maximum time depends also on the IdleRemover scan time, which is 1/2 the smallest idle-timeout-minutes of any pool. |
allocation-retry | The allocation retry element indicates the number of times that allocating a connection should be tried before throwing an exception. The default is 0. |
allocation-retry-wait-millis | The allocation retry wait millis element indicates the time in milliseconds to wait between retrying to allocate a connection. The default is 5000 (5 seconds). |
xa-resource-timeout | Passed to XAResource.setTransactionTimeout(). Default is zero which does not invoke the setter. Specified in seconds |
Table 20.15. Validation elements
Element | Description |
---|---|
background-validation | An element to specify that connections should be validated on a background thread versus being validated prior to use |
background-validation-minutes | The background-validation-minutes element specifies the amount of time, in minutes, that background validation will run. |
use-fast-fail | Whether fail a connection allocation on the first connection if it is invalid (true) or keep trying until the pool is exhausted of all potential connections (false). Default is false |
Table 20.16. Admin object elements
Element | Description |
---|---|
config-property | Specifies an administration object configuration property. |
Table 20.17. Recovery elements
Element | Description |
---|---|
recover-credential | Specifies the user name / password pair or security domain that should be used for recovery. |
recover-plugin | Specifies an implementation of the org.jboss.jca.core.spi.recovery.RecoveryPlugin class. |
jboss-as-resource-adapters_1_0.xsd
and http://docs.jboss.org/ironjacamar/schema/ironjacamar_1_0.xsd for automatic activation.
20.6. View Defined Connection Statistics
deployment=name.rar
subtree.
/subsystem
level as this ensures they are accessible for any rar
that is not defined in any configuration in the standalone.xml
or domain.xml
files.
Example 20.1.
/deployment=example.rar/subsystem=resource-adapters/statistics=statistics/connection-definitions=java\:\/testMe:read-resource(include-runtime=true)
Note
include-runtime=true
argument, as all statistics are runtime only information and the default is false
.
20.7. Resource Adapter Statistics
The following table contains a list of the supported resource adapter core statistics:
Table 20.18. Core Statistics
Name | Description |
---|---|
ActiveCount |
The number of active connections. Each of the connections is either in use by an application or available in the pool
|
AvailableCount |
The number of available connections in the pool.
|
AverageBlockingTime |
The average time spent blocking on obtaining an exclusive lock on the pool. The value is in milliseconds.
|
AverageCreationTime |
The average time spent creating a connection. The value is in milliseconds.
|
CreatedCount |
The number of connections created.
|
DestroyedCount |
The number of connections destroyed.
|
InUseCount |
The number of connections currently in use.
|
MaxCreationTime |
The maximum time it took to create a connection. The value is in milliseconds.
|
MaxUsedCount |
The maximum number of connections used.
|
MaxWaitCount |
The maximum number of requests waiting for a connection at the same time.
|
MaxWaitTime |
The maximum time spent waiting for an exclusive lock on the pool.
|
TimedOut |
The number of timed out connections.
|
TotalBlockingTime |
The total time spent waiting for an exclusive lock on the pool. The value is in milliseconds.
|
TotalCreationTime |
The total time spent creating connections. The value is in milliseconds.
|
WaitCount |
The number of requests that had to wait for a connection.
|
20.8. Deploy the WebSphere MQ Resource Adapter
WebSphere MQ is IBM's Messaging Oriented Middleware (MOM) software that allows applications on distributed systems to communicate with each other. This is accomplished through the use of messages and message queues. WebSphere MQ is responsible for delivering messages to the message queues and for transferring data to other queue managers using message channels. For more information about WebSphere MQ, see WebSphere MQ.
This topic covers the steps to deploy and configure the WebSphere MQ Resource Adapter in JBoss EAP 6. This can be accomplished by manually editing configuration files, using the Management CLI tool, or using the web-based Management Console.
Before you get started, you must verify the version of the WebSphere MQ resource adapter and understand some of the WebSphere MQ configuration properties.
- The WebSphere MQ resource adapter is supplied as a Resource Archive (RAR) file called
wmq.jmsra-VERSION.rar
. You must use version7.0.1.7
or later. - You must know the values of the following WebSphere MQ configuration properties. Refer to the WebSphere MQ product documentation for details about these properties.
- MQ.QUEUE.MANAGER: The name of the WebSphere MQ queue manager
- MQ.HOST.NAME: The host name used to connect to the WebSphere MQ queue manager
- MQ.CHANNEL.NAME: The server channel used to connect to the WebSphere MQ queue manager
- MQ.QUEUE.NAME: The name of the destination queue
- MQ.PORT: The port used to connect to the WebSphere MQ queue manager
- MQ.CLIENT: The transport type
- For outbound connections, you must also be familiar with the following configuration property:
- MQ.CONNECTIONFACTORY.NAME: The name of the connection factory instance that will provide the connection to the remote system
Note
Procedure 20.8. Deploy the Resource Adapter Manually
- If you need transaction support with the WebSphereMQ resource adapter, you must repackage the
wmq.jmsra-VERSION.rar
archive to include themqetclient.jar
. You can use the following command:[user@host ~]$
Be sure to replace the VERSION with the correct version number.jar -uf wmq.jmsra-VERSION.rar mqetclient.jar
- Copy the
wmq.jmsra-VERSION.rar
file to theEAP_HOME/standalone/deployments/
directory. - Add the resource adapter to the server configuration file.
- Open the
EAP_HOME/standalone/configuration/standalone-full.xml
file in an editor. - Find the
urn:jboss:domain:resource-adapters
subsystem in the configuration file. - If there are no resource adapters defined for this subsystem, first replace:
<subsystem xmlns="urn:jboss:domain:resource-adapters:1.0"/>
with this:<subsystem xmlns="urn:jboss:domain:resource-adapters:1.0"> <resource-adapters> <!-- <resource-adapter> configuration listed below --> </resource-adapters> </subsystem>
- The resource adapter configuration depends on whether you need transaction support and recovery. If you do not need transaction support, choose the first configuration step below. If you do need transaction support, choose the second configuration step.
- For non-transactional deployments, replace the
<!-- <resource-adapter> configuration listed below -->
with the following:<resource-adapter> <archive> wmq.jmsra-VERSION.rar </archive> <transaction-support>NoTransaction</transaction-support> <connection-definitions> <connection-definition class-name="com.ibm.mq.connector.outbound.ManagedConnectionFactoryImpl" jndi-name="java:jboss/MQ.CONNECTIONFACTORY.NAME" pool-name="MQ.CONNECTIONFACTORY.NAME"> <config-property name="channel"> MQ.CHANNEL.NAME </config-property> <config-property name="transportType"> MQ.CLIENT </config-property> <config-property name="queueManager"> MQ.QUEUE.MANAGER </config-property> <security> <security-domain>MySecurityDomain</security-domain> </security> </connection-definition> </connection-definitions> <admin-objects> <admin-object class-name="com.ibm.mq.connector.outbound.MQQueueProxy" jndi-name="java:jboss/MQ.QUEUE.NAME" pool-name="MQ.QUEUE.NAME"> <config-property name="baseQueueName"> MQ.QUEUE.NAME </config-property> </admin-object> </admin-objects> </resource-adapter>
Be sure to replace the VERSION with the actual version in the name of the RAR. - For transactional deployments, replace the
<!-- <resource-adapter> configuration listed below -->
with the following:<resource-adapter> <archive> wmq.jmsra-VERSION.rar </archive> <transaction-support>XATransaction</transaction-support> <connection-definitions> <connection-definition class-name="com.ibm.mq.connector.outbound.ManagedConnectionFactoryImpl" jndi-name="java:jboss/MQ.CONNECTIONFACTORY.NAME" pool-name="MQ.CONNECTIONFACTORY.NAME"> <config-property name="channel"> MQ.CHANNEL.NAME </config-property> <config-property name="transportType"> MQ.CLIENT </config-property> <config-property name="queueManager"> MQ.QUEUE.MANAGER </config-property> <security> <security-domain>MySecurityDomain</security-domain> </security> <recovery> <recover-credential> <user-name>USER_NAME</user-name> <password>PASSWORD</password> </recover-credential> </recovery> </connection-definition> </connection-definitions> <admin-objects> <admin-object class-name="com.ibm.mq.connector.outbound.MQQueueProxy" jndi-name="java:jboss/MQ.QUEUE.NAME" pool-name="MQ.QUEUE.NAME"> <config-property name="baseQueueName"> MQ.QUEUE.NAME </config-property> </admin-object> </admin-objects> </resource-adapter>
Be sure to replace the VERSION with the actual version in the name of the RAR. You must also replace the USER_NAME and PASSWORD with the valid user name and password.Note
To support transactions, the <transaction-support> element was set toXATransaction
. To support XA recovery, the <recovery> element was added to the connection definition.
- If you want to change the default provider for the EJB3 messaging system in JBoss EAP 6 from HornetQ to WebSphere MQ, modify the
urn:jboss:domain:ejb3:1.2
subsystem as follows:Replace:<mdb> <resource-adapter-ref resource-adapter-name="hornetq-ra"/> <bean-instance-pool-ref pool-name="mdb-strict-max-pool"/> </mdb>
with:<mdb> <resource-adapter-ref resource-adapter-name="wmq.jmsra-VERSION.rar"/> <bean-instance-pool-ref pool-name="mdb-strict-max-pool"/> </mdb>
Be sure to replace the VERSION with the actual version in the name of the RAR.
Procedure 20.9. Modify the MDB code to use the resource adapter
- Configure the ActivationConfigProperty and ResourceAdapter in the MDB code as follows:
@MessageDriven( name="WebSphereMQMDB", activationConfig = { @ActivationConfigProperty(propertyName = "destinationType",propertyValue = "javax.jms.Queue"), @ActivationConfigProperty(propertyName = "useJNDI", propertyValue = "false"), @ActivationConfigProperty(propertyName = "hostName", propertyValue = "MQ.HOST.NAME"), @ActivationConfigProperty(propertyName = "port", propertyValue = "MQ.PORT"), @ActivationConfigProperty(propertyName = "channel", propertyValue = "MQ.CHANNEL.NAME"), @ActivationConfigProperty(propertyName = "queueManager", propertyValue = "MQ.QUEUE.MANAGER"), @ActivationConfigProperty(propertyName = "destination", propertyValue = "MQ.QUEUE.NAME"), @ActivationConfigProperty(propertyName = "transportType", propertyValue = "MQ.CLIENT") }) @ResourceAdapter(value = "wmq.jmsra-VERSION.rar") @TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED) public class WebSphereMQMDB implements MessageListener { }
Be sure to replace the VERSION with the actual version in the name of the RAR.
Chapter 21. Deploy JBoss EAP 6 on Amazon EC2
21.1. Introduction
21.1.1. About Amazon EC2
21.1.2. About Amazon Machine Instances (AMIs)
21.1.3. About JBoss Cloud Access
21.1.4. JBoss Cloud Access Features
- Red Hat Enterprise Linux 6
- JBoss EAP 6
- The JBoss Operations Network (JON) 3 agent
- Product updates with RPMs using Red Hat Update Infrastructure.
Important
21.1.5. Supported Amazon EC2 Instance Types
Table 21.1. Supported Amazon EC2 Instance Types
Instance Type | Description |
---|---|
Standard Instance |
Standard Instances are general purpose environments with a balanced memory-to-CPU ratio.
|
High Memory Instance |
High Memory Instances have more memory allocated to them than Standard Instances. High Memory Instances are suited for high throughput applications such as databases or memory caching applications.
|
High CPU Instance |
High CPU Instances have more CPU resources allocated than memory and are suited for relatively low throughput but CPU intensive applications.
|
Important
Micro (t1.micro)
is not suitable for deployment of JBoss EAP 6.
21.1.6. Supported Red Hat AMIs
RHEL-osversion-JBEAP-6.0.0-arch-creationdate
6.2
.
x86_64
or i386
.
20120501
.
RHEL-6.2-JBEAP-6.0.0-x86_64-20120501
.
21.2. Deploying JBoss EAP 6 on Amazon EC2
21.2.1. Overview of Deploying JBoss EAP 6 on Amazon EC2
- Red Hat Enterprise Linux 6, https://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/.
- Amazon Web Services, http://aws.amazon.com/documentation/.
21.2.2. Non-clustered JBoss EAP 6
21.2.2.1. About Non-clustered Instances
21.2.2.2. Non-clustered Instances
21.2.2.2.1. Launch a Non-clustered JBoss EAP 6 Instance
This topic covers the steps required to launch a non-clustered instance of JBoss EAP 6 on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- A suitable Red Hat AMI. Refer to Section 21.1.6, “Supported Red Hat AMIs”.
- A pre-configured Security Group which allows incoming requests on at least ports 22, 8080, and 9990.
Procedure 21.1. Launch a Non-clustered Instance of Jboss EAP 6 on a Red Hat AMI (Amazon Machine Image)
- Configure the
User Data
field. The configurable parameters are available here: Section 21.4.1, “Permanent Configuration Parameters”, Section 21.4.2, “Custom Script Parameters”.Example 21.1. Example User Data Field
The example shows the User Data field for a non-clustered JBoss EAP 6 instance. The password for the useradmin
has been set toadminpwd
.JBOSSAS_ADMIN_PASSWORD=adminpwd JBOSS_IP=0.0.0.0 #listen on all IPs and interfaces # In production, access to these ports needs to be restricted for security reasons PORTS_ALLOWED="9990 9443" cat> $USER_SCRIPT << "EOF" # Get the application to be deployed from an Internet URL # mkdir -p /usr/share/java/jboss-ec2-eap-applications # wget https://<your secure storage hostname>/<path>/<app name>.war -O /usr/share/java/jboss-ec2-eap-applications/<app name>.war # Create a file of CLI commands to be executed after starting the server cat> $USER_CLI_COMMANDS << "EOC" # deploy /usr/share/java/jboss-ec2-eap-applications/<app name>.war EOC EOF
For Production Instances
For a production instance, add the following line beneath theUSER_SCRIPT
line of theUser Data
field, to ensure security updates are applied on boot.yum -y update
Note
yum -y update
should be run regularly, to apply security fixes and enhancements.- Launch the Red Hat AMI instance.
A non-clustered instance of JBoss EAP 6 has been configured, and launched on a Red Hat AMI.
21.2.2.2.2. Deploy an Application on a non-clustered JBoss EAP 6 Instance
This topic covers deploying an application to a non-clustered JBoss EAP 6 instance on a Red Hat AMI.
Deploy the Sample Application
Add the following lines to theUser Data
field:# Deploy the sample application from the local filesystem deploy --force /usr/share/java/jboss-ec2-eap-samples/hello.war
Example 21.2. Example User Data Field with Sample Application
This example uses the sample application provided on the Red Hat AMI. It also includes basic configuration for a non-clustered JBoss EAP 6 instance. The password for the useradmin
has been set toadminpwd
.JBOSSAS_ADMIN_PASSWORD=adminpwd JBOSS_IP=0.0.0.0 #listen on all IPs and interfaces # In production, access to these ports needs to be restricted for security reasons PORTS_ALLOWED="9990 9443" cat> $USER_SCRIPT << "EOF" # Create a file of CLI commands to be executed after starting the server cat> $USER_CLI_COMMANDS << "EOC" # Deploy the sample application from the local filesystem deploy --force /usr/share/java/jboss-ec2-eap-samples/hello.war EOC EOF
Deploy a Custom Application
Add the following lines to theUser Data
field, configuring the application name and the URL:# Get the application to be deployed from an Internet URL mkdir -p /usr/share/java/jboss-ec2-eap-applications wget https://<your secure storage hostname>/<path>/<app name>.war -O /usr/share/java/jboss-ec2-eap-applications/<app name>.war
Example 21.3. Example User Data Field with Custom Application
This example uses an application calledMyApp
, and includes basic configuration for a non-clustered JBoss EAP 6 instance. The password for the useradmin
has been set toadminpwd
.JBOSSAS_ADMIN_PASSWORD=adminpwd JBOSS_IP=0.0.0.0 #listen on all IPs and interfaces # In production, access to these ports needs to be restricted for security reasons PORTS_ALLOWED="9990 9443" cat> $USER_SCRIPT << "EOF" # Get the application to be deployed from an Internet URL mkdir -p /usr/share/java/jboss-ec2-eap-applications wget https://PATH_TO_MYAPP/MyApp.war -O /usr/share/java/jboss-ec2-eap-applications/MyApp.war # Create a file of CLI commands to be executed after starting the server cat> $USER_CLI_COMMANDS << "EOC" deploy /usr/share/java/jboss-ec2-eap-applications/MyApp.war EOC EOF
- Launch the Red Hat AMI instance.
The application has been successfully deployed to JBoss EAP 6.
21.2.2.2.3. Test the Non-clustered JBoss EAP 6 Instance
This topic covers the steps required to test that the non-clustered JBoss EAP 6 is running correctly.
Procedure 21.2. Test the Non-clustered Jboss EAP 6 Instance is Running Correctly
- Determine the instance's
Public DNS
, located in the instance's details pane. - Navigate to
http://<public-DNS>:8080
. - Confirm that the JBoss EAP home page appears, including a link to the Admin console. If the home page is not available, refer here: Section 21.5.1, “About Troubleshooting Amazon EC2”.
- Click on the Admin Console hyperlink.
- Log in:
- Username:
admin
- Password: Specified in the
User Data
field here: Section 21.2.2.2.1, “Launch a Non-clustered JBoss EAP 6 Instance”.
Test the Sample Application
Navigate tohttp://<public-DNS>:8080/hello
to test that the sample application is running successfully. The textHello World!
should appear in the browser. If the text is not visible, refer here: Section 21.5.1, “About Troubleshooting Amazon EC2”.- Log out of the JBoss EAP 6 Admin Console.
The JBoss EAP 6 instance is running correctly.
21.2.2.3. Non-clustered Managed Domains
21.2.2.3.1. Launch an Instance to Serve as a Domain Controller
This topic covers the steps required to launch a non-clustered JBoss EAP 6 managed domain on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- A suitable Red Hat AMI. Refer to Section 21.1.6, “Supported Red Hat AMIs”.
Procedure 21.3. Launch a non-clustered JBoss EAP 6 managed domain on a Red Hat AMI
- In the Security Group tab, ensure all traffic is allowed. Red Hat Enterprise Linux's built-in firewall capabilities can be used to restrict access if desired.
- Set the public subnet of the VPC to running.
- Select a static IP.
- Configure the
User Data
field. The configurable parameters are available here: Section 21.4.1, “Permanent Configuration Parameters”, Section 21.4.2, “Custom Script Parameters”.Example 21.4. Example User Data Field
The example shows the User Data field for a non-clustered JBoss EAP 6 managed domain. The password for the useradmin
has been set toadmin
.## password that will be used by slave host controllers to connect to the domain controller JBOSSAS_ADMIN_PASSWORD=admin ## subnet prefix this machine is connected to SUBNET=10.0.0. #### to run the example no modifications below should be needed #### JBOSS_DOMAIN_CONTROLLER=true PORTS_ALLOWED="9999 9990 9443" JBOSS_IP=`hostname | sed -e 's/ip-//' -e 'y/-/./'` #listen on public/private EC2 IP address cat > $USER_SCRIPT << "EOF" ## Get the application to be deployed from an Internet URL # mkdir -p /usr/share/java/jboss-ec2-eap-applications # wget https://<your secure storage hostname>/<path>/<app name>.war -O /usr/share/java/jboss-ec2-eap-applications/<app name>.war ## Create a file of CLI commands to be executed after starting the server cat> $USER_CLI_COMMANDS << "EOC" # Add the modcluster subsystem to the default profile to set up a proxy /profile=default/subsystem=web/connector=ajp:add(name=ajp,protocol=AJP/1.3,scheme=http,socket-binding=ajp) /:composite(steps=[ {"operation" => "add", "address" => [ ("profile" => "default"), ("subsystem" => "modcluster") ] },{ "operation" => "add", "address" => [ ("profile" => "default"), ("subsystem" => "modcluster"), ("mod-cluster-config" => "configuration") ], "advertise" => "false", "proxy-list" => "${jboss.modcluster.proxyList}", "connector" => "ajp"}, { "operation" => "add", "address" => [ ("profile" => "default"), ("subsystem" => "modcluster"), ("mod-cluster-config" => "configuration"), ("dynamic-load-provider" => "configuration") ]}, { "operation" => "add", "address" => [ ("profile" => "default"), ("subsystem" => "modcluster"), ("mod-cluster-config" => "configuration"), ("dynamic-load-provider" => "configuration"), ("load-metric" => "busyness")], "type" => "busyness"} ]) # Deploy the sample application from the local filesystem deploy /usr/share/java/jboss-ec2-eap-samples/hello.war --server-groups=main-server-group EOC ## this will workaround the problem that in a VPC, instance hostnames are not resolvable echo -e "127.0.0.1\tlocalhost.localdomain localhost" > /etc/hosts echo -e "::1\tlocalhost6.localdomain6 localhost6" >> /etc/hosts for (( i=1 ; i<255 ; i++ )); do echo -e "$SUBNET$i\tip-${SUBNET//./-}$i" ; done >> /etc/hosts EOF
For Production Instances
For a production instance, add the following line beneath theUSER_SCRIPT
line of theUser Data
field, to ensure security updates are applied on boot.yum -y update
Note
yum -y update
should be run regularly, to apply security fixes and enhancements.- Launch the Red Hat AMI instance.
A non-clustered JBoss EAP 6 managed domain has been configured, and launched on a Red Hat AMI.
21.2.2.3.2. Launch One or More Instances to Serve as Host Controllers
This topic covers the steps required to launch one or more instances of JBoss EAP 6 to serve as non-clustered host controllers on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- Configure and launch the non-clustered domain controller. Refer to Section 21.2.2.3.1, “Launch an Instance to Serve as a Domain Controller” .
Procedure 21.4. Launch Host Controllers
- Select an AMI.
- Define the desired number of instances (the number of slave host controllers).
- Select the VPC and instance type.
- Click on Security Group.
- Ensure that all traffic from the JBoss EAP 6 subnet is allowed.
- Define other restrictions as desired.
- Add the following into the User Data field:
## mod cluster proxy addresses MOD_CLUSTER_PROXY_LIST=10.0.0.4:7654 ## host controller setup JBOSS_DOMAIN_MASTER_ADDRESS=10.0.0.5 JBOSS_HOST_PASSWORD=<password for slave host controllers> ## subnet prefix this machine is connected to SUBNET=10.0.1. #### to run the example no modifications below should be needed #### JBOSS_HOST_USERNAME=admin PORTS_ALLOWED="1024:65535" JBOSS_IP=`hostname | sed -e 's/ip-//' -e 'y/-/./'` #listen on public/private EC2 IP address cat > $USER_SCRIPT << "EOF" ## Server instance configuration sed -i "s/other-server-group/main-server-group/" $JBOSS_CONFIG_DIR/$JBOSS_HOST_CONFIG ## this will workaround the problem that in a VPC, instance hostnames are not resolvable echo -e "127.0.0.1\tlocalhost.localdomain localhost" > /etc/hosts echo -e "::1\tlocalhost6.localdomain6 localhost6" >> /etc/hosts for (( i=1 ; i<255 ; i++ )); do echo -e "$SUBNET$i\tip-${SUBNET//./-}$i" ; done >> /etc/hosts EOF
For Production Instances
For a production instance, add the following line beneath theUSER_SCRIPT
line of theUser Data
field, to ensure security updates are applied on boot.yum -y update
Note
yum -y update
should be run regularly, to apply security fixes and enhancements.- Launch the Red Hat AMI instance.
The JBoss EAP 6 non-clustered host controllers are configured and launched on a Red Hat AMI.
21.2.2.3.3. Test the Non-Clustered JBoss EAP 6 Managed Domain
This topic covers the steps required to test the non-clustered JBoss EAP 6 managed domain on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- Configure and launch the domain controller. Refer to Section 21.2.2.3.1, “Launch an Instance to Serve as a Domain Controller” .
- Configure and launch the host controllers. Refer to Section 21.2.2.3.2, “Launch One or More Instances to Serve as Host Controllers” .
Procedure 21.5. Test the Web Server
- Navigate to
http://ELASTIC_IP_OF_APACHE_HTTPD
in a browser to confirm the web server is running successfully.
Procedure 21.6. Test the Domain Controller
- Navigate to
http://ELASTIC_IP_OF_DOMAIN_CONTROLLER:9990/console
- Log in using the username of
admin
and the password specified in the User Data field for the domain controller and the admin console landing page for a managed domain should appear (http://ELASTIC_IP_OF_DOMAIN_CONTROLLER:9990/console/App.html#server-instances
). - Click the Server label at the top right side of the screen, and select any of the host controllers in the Host dropdown menu at the top left side of the screen.
- Verify that each host controller has two server configurations called
server-one
andserver-two
and that they both belong to themain-server-group
. - Log out of the JBoss EAP 6 Admin Console.
Procedure 21.7. Test the Host Controllers
- Navigate to
http://ELASTIC_IP_OF_APACHE_HTTPD/hello
to test that the sample application is running successfully. The textHello World!
should appear in the browser.If the text is not visible, refer here: Section 18.5.1, "About Troubleshooting Amazon EC2". - Connect to the Apache HTTPD instance:
$ ssh -L7654:localhost:7654 ELASTIC_IP_OF_APACHE_HTTPD
- Navigate to
http://localhost:7654/mod_cluster-manager
to confirm all instances are running correctly.
The JBoss EAP 6 web server, domain controller, and host controllers are running correctly on a Red Hat AMI.
21.2.3. Clustered JBoss EAP 6
21.2.3.1. About Clustered Instances
standalone-ec2-ha.xml
and standalone-mod_cluster-ec2-ha.xml
. Each of these configuration files provides clustering without the use of multicast because Amazon EC2 does not support multicast. This is done by using TCP unicast for cluster communications and S3_PING as the discovery protocol. The standalone-mod_cluster-ec2-ha.xml
configuration also provides easy registration with mod_cluster proxies.
domain-ec2.xml
configuration file provides two profiles for use in clustered managed domains: ec2-ha, and mod_cluster-ec2-ha.
21.2.3.2. Create a Relational Database Service Database Instance
This topic covers the steps to create a relational database service database instance, using MySQL as an example.
Warning
Important
Procedure 21.8. Create a Relational Database Service Database Instance
- Click on the RDS in the AWS console.
- Subscribe to the service if needed.
- Click on Launch DB instance.
- Click on MySQL.
- Select a version. For example,
5.5.12
. - Select small instance.
- Ensure Multi-AZ Deployment and Auto upgrade are
off
. - Set Storage to
5GB
. - Define the database administrator's username and password and click Next.
- Select a database name to be created with the instance, and click Next.
- Disable back-ups and maintenance, if necessary.
- Confirm the settings.
The database is created. It will initialize and be ready for use after a few minutes.
21.2.3.3. About Virtual Private Clouds
21.2.3.4. Create a Virtual Private Cloud (VPC)
This topic covers the steps required to create a Virtual Private Cloud, using a database external to the VPC as an example. Your security policies may require connection to the database to be encrypted. Please refer to Amazon's RDS FAQ for details about encrypting the database connections.
Important
- Go to the VPC tab in the AWS console.
- Subscribe to the service if needed.
- Click on "Create new VPC".
- Choose a VPC with one public and one private subnet.
- Set the public subnet to be
10.0.0.0/24
. - Set the private subnet to be
10.0.1.0/24
.
- Go to Elastic IPs.
- Create an elastic IP for use by the mod_cluster proxy/NAT instance.
- Go to Security groups and create a security group to allow all traffic in and out.
- Go to Network ACLs
- Create an ACL to allow all traffic in and out.
- Create an ACL to allow all traffic out and traffic in on only TCP ports
22
,8009
,8080
,8443
,9443
,9990
and16163
.
The Virtual Private Cloud has been successfully created.
21.2.3.5. Launch an Apache HTTPD instance to serve as a mod_cluster proxy and a NAT instance for the VPC
This topic covers the steps required to launch an Apache HTTPD instance to serve as a mod_cluster proxy and a NAT instance for the Virtual Private Cloud.
Prerequisites
Procedure 21.9. Launch an Apache HTTPD instance to serve as a mod_cluster proxy and a NAT instance for the VPC
- Create an elastic IP for this instance.
- Select an AMI.
- Go to Security Group and allow all traffic (use Red Hat Enterprise Linux's built-in firewall capabilities to restrict access if desired).
- Select "
running
" in the public subnet of the VPC. - Select a static IP (e.g.
10.0.0.4
). - Put the following in the User Data: field:
JBOSSCONF=disabled cat > $USER_SCRIPT << "EOS" echo 1 > /proc/sys/net/ipv4/ip_forward echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter iptables -I INPUT 4 -s 10.0.1.0/24 -p tcp --dport 7654 -j ACCEPT iptables -I INPUT 4 -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I FORWARD -s 10.0.1.0/24 -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 ! -s 10.0.0.4 -j MASQUERADE # balancer module incompatible with mod_cluster sed -i -e 's/LoadModule proxy_balancer_module/#\0/' /etc/httpd/conf/httpd.conf cat > /etc/httpd/conf.d/mod_cluster.conf << "EOF" #LoadModule proxy_module modules/mod_proxy.so #LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule slotmem_module modules/mod_slotmem.so LoadModule manager_module modules/mod_manager.so LoadModule proxy_cluster_module modules/mod_proxy_cluster.so LoadModule advertise_module modules/mod_advertise.so Listen 7654 # workaround JBPAPP-4557 MemManagerFile /var/cache/mod_proxy/manager <VirtualHost *:7654> <Location /mod_cluster-manager> SetHandler mod_cluster-manager Order deny,allow Deny from all Allow from 127.0.0.1 </Location> <Location /> Order deny,allow Deny from all Allow from 10. Allow from 127.0.0.1 </Location> KeepAliveTimeout 60 MaxKeepAliveRequests 0 ManagerBalancerName mycluster ServerAdvertise Off EnableMCPMReceive On </VirtualHost> EOF echo "`hostname | sed -e 's/ip-//' -e 'y/-/./'` `hostname`" >> /etc/hosts semanage port -a -t http_port_t -p tcp 7654 #add port in the apache port list for the below to work setsebool -P httpd_can_network_relay 1 #for mod_proxy_cluster to work chcon -t httpd_config_t -u system_u /etc/httpd/conf.d/mod_cluster.conf #### Uncomment the following line when launching a managed domain #### # setsebool -P httpd_can_network_connect 1 service httpd start EOS
- Disable the Amazon EC2 cloud source/destination checking for this instance so it can act as a router.
- Right-click on the running Apache HTTPD instance and choose "Change Source/Dest check".
- Click on Yes, Disable.
- Assign the elastic IP to this instance.
The Apache HTTPD instance has been launched successfully.
21.2.3.6. Configure the VPC Private Subnet Default Route
This topic covers the steps required to configure the VPC private subnet default route. JBoss EAP 6 cluster nodes will run in the private subnet of the VPC, but cluster nodes require Internet access for S3 connectivity. A default route needs to be set to go through the NAT instance.
Procedure 21.10. Configure the VPC Private Subnet Default Route
- Navigate to the Apache HTTPD instance in the Amazon AWS console.
- Navigate to the VPC → route tables.
- Click on the routing table used by the private subnet.
- In the field for a new route enter
0.0.0.0/0
. - Click on "Select a target".
- Select "
Enter Instance ID
". - Choose the ID of the running Apache HTTPD instance.
The default route has been successfully configured for the VPC subnet.
21.2.3.7. About Identity and Access Management (IAM)
21.2.3.8. Configure IAM Setup
This topic covers the configuration steps required for setting up IAM for clustered JBoss EAP 6 instances. The S3_PING
protocol uses an S3 bucket to discover other cluster members. JGroups version 3.0.x requires Amazon AWS account access and secret keys to authenticate against the S3 service.
Procedure 21.11. Configure IAM Setup
- Go to the IAM tab in the AWS console.
- Click on users.
- Select Create New Users.
- Choose a name, and ensure the Generate an access key for each User option is checked.
- Select Download credentials, and save them in a secure location.
- Close the window.
- Click on the newly created user.
- Make note of the
User ARM
value. This value is required to set up the S3 bucket, documented here: Section 21.2.3.10, “Configure S3 Bucket Setup”.
The IAM user account has been successfully created.
21.2.3.9. About the S3 Bucket
21.2.3.10. Configure S3 Bucket Setup
This topic covers the steps required to configure a new S3 bucket.
Prerequisites
Procedure 21.12. Configure S3 Bucket Setup
- Open the S3 tab in the AWS console.
- Click on Create Bucket.
- Choose a name for the bucket and click Create.
Note
Bucket names are unique across the entire S3. Names cannot be reused. - Right click on the new bucket and select Properties.
- Click Add bucket policy in the permissions tab.
- Click New policy to open the policy creation wizard.
- Copy the following content into the new policy, replacing
arn:aws:iam::05555555555:user/jbosscluster*
with the value defined here: Section 21.2.3.8, “Configure IAM Setup”. Change both instances ofclusterbucket123
to the name of the bucket defined in step 3 of this procedure.{ "Version": "2008-10-17", "Id": "Policy1312228794320", "Statement": [ { "Sid": "Stmt1312228781799", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::055555555555:user/jbosscluster" ] }, "Action": [ "s3:ListBucketVersions", "s3:GetObjectVersion", "s3:ListBucket", "s3:PutBucketVersioning", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetBucketVersioning" ], "Resource": [ "arn:aws:s3:::clusterbucket123/*", "arn:aws:s3:::clusterbucket123" ] } ] }
A new S3 bucket has been created, and configured successfully.
21.2.3.11. Clustered Instances
21.2.3.11.1. Launch Clustered JBoss EAP 6 AMIs
This topic covers the steps required to launch clustered JBoss EAP 6 AMIs.
Prerequisites
Warning
JBOSS_CLUSTER_ID
variable for information on how to make such a configuration work reliably: Section 21.4.1, “Permanent Configuration Parameters”.
Important
Warning
Procedure 21.13. Launch Clustered JBoss EAP 6 AMIs
- Select an AMI.
- Define the desired number of instances (the cluster size).
- Select the VPC and instance type.
- Click on Security Group.
- Ensure that all traffic from the JBoss EAP 6 cluster subnet is allowed.
- Define other restrictions as desired.
- Add the following into the User Data field:
Example 21.5. Example User Data Field
## mod cluster proxy addresses MOD_CLUSTER_PROXY_LIST=10.0.0.4:7654 ## clustering setup JBOSS_JGROUPS_S3_PING_SECRET_ACCESS_KEY=<your secret key> JBOSS_JGROUPS_S3_PING_ACCESS_KEY=<your access key> JBOSS_JGROUPS_S3_PING_BUCKET=<your bucket name> ## password to access admin console JBOSSAS_ADMIN_PASSWORD=<your password for opening admin console> ## database credentials configuration JAVA_OPTS="$JAVA_OPTS -Ddb.host=instancename.something.rds.amazonaws.com -Ddb.database=mydatabase -Ddb.user=<user> -Ddb.passwd=<pass>" ## subnet prefix this machine is connected to SUBNET=10.0.1. #### to run the example no modifications below should be needed #### PORTS_ALLOWED="1024:65535" JBOSS_IP=`hostname | sed -e 's/ip-//' -e 'y/-/./'` #listen on public/private EC2 IP address cat > $USER_SCRIPT << "EOF" ## Get the application to be deployed from an Internet URL # mkdir -p /usr/share/java/jboss-ec2-eap-applications # wget https://<your secure storage hostname>/<path>/<app name>.war -O /usr/share/java/jboss-ec2-eap-applications/<app name>.war ## install the JDBC driver as a core module yum -y install mysql-connector-java mkdir -p /usr/share/jbossas/modules/com/mysql/main cp -v /usr/share/java/mysql-connector-java-*.jar /usr/share/jbossas/modules/com/mysql/main/mysql-connector-java.jar cat > /usr/share/jbossas/modules/com/mysql/main/module.xml <<"EOM" <?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.0" name="com.mysql"> <resources> <resource-root path="mysql-connector-java.jar"/> </resources> <dependencies> <module name="javax.api"/> </dependencies> </module> EOM cat > $USER_CLI_COMMANDS << "EOC" ## Deploy sample application from local filesystem deploy --force /usr/share/java/jboss-ec2-eap-samples/cluster-demo.war ## ExampleDS configuration for MySQL database data-source remove --name=ExampleDS /subsystem=datasources/jdbc-driver=mysql:add(driver-name="mysql",driver-module-name="com.mysql") data-source add --name=ExampleDS --connection-url="jdbc:mysql://${db.host}:3306/${db.database}" --jndi-name=java:jboss/datasources/ExampleDS --driver-name=mysql --user-name="${db.user}" --password="${db.passwd}" /subsystem=datasources/data-source=ExampleDS:enable /subsystem=datasources/data-source=ExampleDS:test-connection-in-pool EOC ## this will workaround the problem that in a VPC, instance hostnames are not resolvable echo -e "127.0.0.1\tlocalhost.localdomain localhost" > /etc/hosts echo -e "::1\tlocalhost6.localdomain6 localhost6" >> /etc/hosts for (( i=1 ; i<255 ; i++ )); do echo -e "$SUBNET$i\tip-${SUBNET//./-}$i" ; done >> /etc/hosts EOF
The clustered JBoss EAP 6 AMIs have been configured and launched successfully.
21.2.3.11.2. Test the Clustered JBoss EAP 6 Instance
This topic covers the steps to confirm that the clustered JBoss EAP 6 instances are running correctly.
Procedure 21.14. Testing the Clustered Instance
- Navigate to http://ELASTIC_IP_OF_APACHE_HTTPD in a browser to confirm the web server is running successfully.
Test the Clustered Nodes
- Navigate to http://ELASTIC_IP_OF_APACHE_HTTPD/cluster-demo/put.jsp in a browser.
- Verify that one of the cluster nodes logs the following message:
Putting date now
- Stop the cluster node that logged the message in the previous step.
- Navigate to http://ELASTIC_IP_OF_APACHE_HTTPD/cluster-demo/get.jsp in a browser.
- Verify that the time shown is the same as the time that was PUT using
put.jsp
in Step 2-a. - Verify that one of the running cluster nodes logs the following message:
Getting date now
- Restart the stopped clustered node.
- Connect to the Apache HTTPD instance:
ssh -L7654:localhost:7654 <ELASTIC_IP_OF_APACHE_HTTPD>
- Navigate to http://localhost:7654/mod_cluster-manager to confirm all instances are running correctly.
The clustered JBoss EAP 6 instance have been tested, and confirmed to be working correctly.
21.2.3.12. Clustered Managed Domains
21.2.3.12.1. Launch an Instance to Serve as a Cluster Domain Controller
This topic covers the steps required to launch a clustered JBoss EAP 6 managed domain on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- A suitable Red Hat AMI. Refer to Section 21.1.6, “Supported Red Hat AMIs” .
Procedure 21.15. Launch a Cluster Domain Contoller
- Create an elastic IP for this instance.
- Select an AMI.
- Go to Security Group and allow all traffic (use Red Hat Enterprise Linux's built-in firewall capabilities to restrict access if desired).
- Choose "running" in the public subnet of the VPC.
- Choose a static IP (e.g. 10.0.0.5).
- Put the following in the User Data: field:
## mod cluster proxy addresses MOD_CLUSTER_PROXY_LIST=10.0.0.4:7654 ## password that will be used by slave host controllers to connect to the domain controller JBOSSAS_ADMIN_PASSWORD=<password for slave host controllers> ## subnet prefix this machine is connected to SUBNET=10.0.0. #### to run the example no modifications below should be needed #### JBOSS_DOMAIN_CONTROLLER=true PORTS_ALLOWED="9999 9990 9443" JBOSS_IP=`hostname | sed -e 's/ip-//' -e 'y/-/./'` #listen on public/private EC2 IP address cat > $USER_SCRIPT << "EOF" ## Get the application to be deployed from an Internet URL # mkdir -p /usr/share/java/jboss-ec2-eap-applications # wget https://<your secure storage hostname>/<path>/<app name>.war -O /usr/share/java/jboss-ec2-eap-applications/<app name>.war ## Install the JDBC driver as a core module yum -y install mysql-connector-java mkdir -p /usr/share/jbossas/modules/com/mysql/main cp -v /usr/share/java/mysql-connector-java-*.jar /usr/share/jbossas/modules/com/mysql/main/mysql-connector-java.jar cat > /usr/share/jbossas/modules/com/mysql/main/module.xml <<"EOM" <?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.0" name="com.mysql"> <resources> <resource-root path="mysql-connector-java.jar"/> </resources> <dependencies> <module name="javax.api"/> </dependencies> </module> EOM cat > $USER_CLI_COMMANDS << "EOC" ## Deploy the sample application from the local filesystem deploy /usr/share/java/jboss-ec2-eap-samples/cluster-demo.war --server-groups=other-server-group ## ExampleDS configuration for MySQL database data-source --profile=mod_cluster-ec2-ha remove --name=ExampleDS /profile=mod_cluster-ec2-ha/subsystem=datasources/jdbc-driver=mysql:add(driver-name="mysql",driver-module-name="com.mysql") data-source --profile=mod_cluster-ec2-ha add --name=ExampleDS --connection-url="jdbc:mysql://${db.host}:3306/${db.database}" --jndi-name=java:jboss/datasources/ExampleDS --driver-name=mysql --user-name="${db.user}" --password="${db.passwd}" /profile=mod_cluster-ec2-ha/subsystem=datasources/data-source=ExampleDS:enable EOC ## this will workaround the problem that in a VPC, instance hostnames are not resolvable echo -e "127.0.0.1\tlocalhost.localdomain localhost" > /etc/hosts echo -e "::1\tlocalhost6.localdomain6 localhost6" >> /etc/hosts for (( i=1 ; i<255 ; i++ )); do echo -e "$SUBNET$i\tip-${SUBNET//./-}$i" ; done >> /etc/hosts EOF
For Production Instances
For a production instance, add the following line beneath theUSER_SCRIPT
line of theUser Data
field, to ensure security updates are applied on boot.yum -y update
Note
yum -y update
should be run regularly, to apply security fixes and enhancements.- Launch the Red Hat AMI instance.
A clustered JBoss EAP 6 managed domain is configured and launched on a Red Hat AMI.
21.2.3.12.2. Launch One or More Instances to Serve as Cluster Host Controllers
This topic covers the steps required to launch one or more instances of JBoss EAP 6 to serve as cluster host controllers on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- Configure and launch the cluster domain controller. Refer to Section 21.2.3.12.1, “Launch an Instance to Serve as a Cluster Domain Controller” .
Procedure 21.16. Launch Host Controllers
- Select an AMI.
- Define the desired number of instances (the number of slave host controllers).
- Select the VPC and instance type.
- Click on Security Group.
- Ensure that all traffic from the JBoss EAP 6 cluster subnet is allowed.
- Define other restrictions as desired.
- Add the following into the User Data field:
## mod cluster proxy addresses MOD_CLUSTER_PROXY_LIST=10.0.0.4:7654 ## clustering setup JBOSS_JGROUPS_S3_PING_SECRET_ACCESS_KEY=<your secret key> JBOSS_JGROUPS_S3_PING_ACCESS_KEY=<your access key> JBOSS_JGROUPS_S3_PING_BUCKET=<your bucket name> ## host controller setup JBOSS_DOMAIN_MASTER_ADDRESS=10.0.0.5 JBOSS_HOST_PASSWORD=<password for slave host controllers> ## database credentials configuration JAVA_OPTS="$JAVA_OPTS -Ddb.host=instancename.something.rds.amazonaws.com -Ddb.database=mydatabase -Ddb.user=<user> -Ddb.passwd=<pass>" ## subnet prefix this machine is connected to SUBNET=10.0.1. #### to run the example no modifications below should be needed #### JBOSS_HOST_USERNAME=admin PORTS_ALLOWED="1024:65535" JBOSS_IP=`hostname | sed -e 's/ip-//' -e 'y/-/./'` #listen on public/private EC2 IP address cat > $USER_SCRIPT << "EOF" ## Server instance configuration sed -i "s/main-server-group/other-server-group/" $JBOSS_CONFIG_DIR/$JBOSS_HOST_CONFIG ## install the JDBC driver as a core module yum -y install mysql-connector-java mkdir -p /usr/share/jbossas/modules/com/mysql/main cp -v /usr/share/java/mysql-connector-java-*.jar /usr/share/jbossas/modules/com/mysql/main/mysql-connector-java.jar cat > /usr/share/jbossas/modules/com/mysql/main/module.xml <<"EOM" <?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.0" name="com.mysql"> <resources> <resource-root path="mysql-connector-java.jar"/> </resources> <dependencies> <module name="javax.api"/> </dependencies> </module> EOM ## this will workaround the problem that in a VPC, instance hostnames are not resolvable echo -e "127.0.0.1\tlocalhost.localdomain localhost" > /etc/hosts echo -e "::1\tlocalhost6.localdomain6 localhost6" >> /etc/hosts for (( i=1 ; i<255 ; i++ )); do echo -e "$SUBNET$i\tip-${SUBNET//./-}$i" ; done >> /etc/hosts EOF
For Production Instances
For a production instance, add the following line beneath theUSER_SCRIPT
line of theUser Data
field, to ensure security updates are applied on boot.yum -y update
Note
yum -y update
should be run regularly, to apply security fixes and enhancements.- Launch the Red Hat AMI instance.
The JBoss EAP 6 cluster host controllers are configured and launched on a Red Hat AMI.
21.2.3.12.3. Test the Clustered JBoss EAP 6 Managed Domain
This topic covers the steps required to test the clustered JBoss EAP 6 managed domain on a Red Hat AMI (Amazon Machine Image).
Prerequisites
- Configure and launch the cluster domain controller. Refer to Section 21.2.3.12.1, “Launch an Instance to Serve as a Cluster Domain Controller” .
- Configure and launch the cluster host controllers. Refer to Section 21.2.3.12.2, “Launch One or More Instances to Serve as Cluster Host Controllers” .
Procedure 21.17. Test the Apache HTTPD instance
- Navigate to
http://ELASTIC_IP_OF_APACHE_HTTPD
in a browser to confirm the web server is running successfully.
Procedure 21.18. Test the Domain Controller
- Navigate to
http://ELASTIC_IP_OF_DOMAIN_CONTROLLER:9990/console
- Log in using the username
admin
and the password specified in the User Data field for the domain controller. Once logged in, the admin console landing page for a managed domain should appear (http://ELASTIC_IP_OF_DOMAIN_CONTROLLER:9990/console/App.html#server-instances
). - Click the Server label at the top right side of the screen. Select any of the host controllers in the Host dropdown menu at the top left side of the screen.
- Verify that this host controller has two server configurations called
server-one
andserver-two
and verify that they both belong to theother-server-group
.
Procedure 21.19. Test the Host Controllers
- Navigate to
http://ELASTIC_IP_OF_APACHE_HTTPD/cluster-demo/put.jsp
in a browser. - Verify that one of the host controllers logs the following message:
Putting date now.
- Stop the server instance that logged the message in the previous step (see Section 2.8.3, Stop a Server Using the Management Console).
- Navigate to
http://ELASTIC_IP_OF_APACHE_HTTPD/cluster-demo/get.jsp
in a browser. - Verify that the time shown is the same as the time that was
PUT
usingput.jsp
in Step 2. - Verify that one of the running server instances logs the following message:
Getting date now.
- Restart the stopped server instance (see Section 2.8.3, Start a Server Using the Management Console)
- Connect to the Apache HTTPD instance.
$ ssh -L7654:localhost:7654 ELASTIC_IP_OF_APACHE_HTTPD
- Navigate to
http://localhost:7654/mod_cluster-manager
to confirm all instances are running correctly.
The JBoss EAP 6 web server, domain controller, and host controllers are running correctly on a Red Hat AMI.
21.3. Establishing Monitoring with JBoss Operations Network (JON)
21.3.1. About AMI Monitoring
Figure 21.1. JON Server connectivity
21.3.2. About Connectivity Requirements
21.3.3. About Network Address Translation (NAT)
rhq.communications.connector.*
description for the agent-configuration.xml
configuration file.
21.3.4. About Amazon EC2 and DNS
21.3.5. About Routing in EC2
source/destination checking
routing feature activated by default. This feature drops any packets being sent to the server which have a destination different from the machine's IP address. If the VPN solution selected for connecting agents to the JON server includes a router, this feature needs to be turned off for the server or servers acting as routers or VPN gateways. This configuration setting can be accessed via the Amazon AWS console. Disabled source/destination checking
is also required in a Virtual Private Cloud (VPC).
- When creating a VPC, avoid allocating addresses already in use in the private network to avoid connectivity problems.
- If an instance needs access to availability zone local resources, make sure Amazon EC2 private addresses are used and traffic is not routed through the VPN.
- If an Amazon EC2 instance will access a small subset of corporate private network addresses (for example only JON servers), only these addresses should be routed through the VPN. This increases security and lowers the chance of Amazon EC2 or private network address space collisions.
21.3.6. About Terminating and Restarting with JON
JON_AGENT_ADDR
in /etc/sysconfig/jon-agent-ec2
to reflect the new IP address and restart the agent.
21.3.7. Configure an Instance to Register with JBoss Operations Network
- For JBoss EAP 6, add this to the User Data field.
JON_SERVER_ADDR=jon2.it.example.com ## if instance not already configured to resolve its hostname JON_AGENT_ADDR=`ip addr show dev eth0 primary to 0/0 | sed -n 's#.*inet \([0-9.]\+\)/.*#\1#p'` PORTS_ALLOWED=16163 # insert other JON options when necessary, see Appendix I
21.4. User Script Configuration
21.4.1. Permanent Configuration Parameters
The following parameters can be used to influence the configuration and operation of JBoss EAP 6. Their contents are written to /etc/sysconfig/jbossas
and /etc/sysconfig/jon-agent-ec2
.
Table 21.2. Configurable Parameters
Name | Description | Default |
---|---|---|
JBOSS_JGROUPS_S3_PING_ACCESS_KEY | Amazon AWS user account access key for S3_PING discovery if clustering is used. | N/A |
JBOSS_JGROUPS_S3_PING_SECRET_ACCESS_KEY | Amazon AWS user account secret access key. | N/A |
JBOSS_JGROUPS_S3_PING_BUCKET | Amazon S3 bucket to be used for S3_PING discovery. | N/A |
JBOSS_CLUSTER_ID |
ID of cluster member nodes. Only used for clustering. Accepted values are (in order):
| Last octet of eth0's IP address |
MOD_CLUSTER_PROXY_LIST | Comma-delimited list of IPs/hostnames of mod_cluster proxies if mod_cluster is to be used. | N/A |
PORTS_ALLOWED | List of incoming ports to be allowed by firewall in addition to the default ones. | N/A |
JBOSSAS_ADMIN_PASSWORD | Password for the admin user. | N/A |
JON_SERVER_ADDR | JON server hostname or IP with which to register. This is only used for registration, after that the agent may communicate with other servers in the JON cluster. | N/A |
JON_SERVER_PORT | Port used by the agent to communicate with the server. | 7080 |
JON_AGENT_NAME | Name of JON agent, must be unique. | Instance's ID |
JON_AGENT_PORT | Port that the agent listens on. | 16163 |
JON_AGENT_ADDR | IP address that the JON agent is to be bound to. This is used when the server has more than one public address, (e.g. VPN). | JON agent chooses the IP of local hostname by default. |
JON_AGENT_OPTS | Additional JON agent system properties which can be used for configuring SSL, NAT and other advanced settings. | N/A |
JBOSS_SERVER_CONFIG |
Name of JBoss EAP server configuration file to use. If JBOSS_DOMAIN_CONTROLLER=true, then
domain-ec2.xml is used. Otherwise:
| standalone.xml , standalone-full.xml , standalone-ec2-ha.xml , standalone-mod_cluser-ec2-ha.xml , domain-ec2.xml depending on the other parameters. |
JAVA_OPTS | Custom values to be added to the variable before JBoss EAP 6 starts. | JAVA_OPTS is built from the values of other parameters. |
JBOSS_IP | IP address that the server is to be bound to. | 127.0.0.1 |
JBOSSCONF | The name of the JBoss EAP 6 profile to start. To prevent JBoss EAP 6 from starting, JBOSSCONF can be set to disabled | standalone |
JBOSS_DOMAIN_CONTROLLER
|
Sets whether or not this instance will run as a domain controller.
| false
|
JBOSS_DOMAIN_MASTER_ADDRESS
|
IP address of remote domain controller.
|
N/A
|
JBOSS_HOST_NAME
|
The logical host name (within the domain). This needs to be distinct.
|
The value of the HOSTNAME environment variable.
|
JBOSS_HOST_USERNAME
|
The username the host controller should use when registering with the domain controller. If not provided, the JBOSS_HOST_NAME is used instead.
|
JBOSS_HOST_NAME
|
JBOSS_HOST_PASSWORD
|
The password the host controller should use when registering with the domain controller.
|
N/A
|
JBOSS_HOST_CONFIG
|
If JBOSS_DOMAIN_CONTROLLER=true, then
host-master.xml is used. If JBOSS_DOMAIN_MASTER_ADDRESS is present, then host-slave.xml is used.
| host-master.xml or host-slave.xml , depending on the other parameters.
|
21.4.2. Custom Script Parameters
The following parameters can be used in the user customization section of the User Data: field.
Table 21.3. Configurable Parameters
Name | Description |
---|---|
JBOSS_DEPLOY_DIR
|
Deploy directory of the active profile (for example,
/var/lib/jbossas/standalone/deployments/ ). Deployable archives placed in this directory will be deployed. Red Hat recommends using the Management Console or CLI tool to manage deployments instead of using the deploy directory.
|
JBOSS_CONFIG_DIR
|
Config directory of the active profile (for example,
/var/lib/jbossas/standalone/configuration ).
|
JBOSS_HOST_CONFIG
|
Name of the active host configuration file (for example,
host-master.xml ). Red Hat recommends using the Management Console or CLI tools to configure the server instead of editing the configuration file.
|
JBOSS_SERVER_CONFIG
|
Name of the active server configuration file (for example,
standalone-ec2-ha.xml ). Red Hat recommends using the Management Console or CLI tools to configure the server instead of editing the configuration file.
|
USER_SCRIPT
|
Path to the custom configuration script, which is available prior to sourcing user-data configuration.
|
USER_CLI_COMMANDS
|
Path to a custom file of CLI commands, which is available prior to sourcing user-data configuration.
|
21.5. Troubleshooting
21.5.1. About Troubleshooting Amazon EC2
21.5.2. Diagnostic Information
/var/log/jboss_user-data.out
is the output of the jboss-ec2-eap init script and user custom configuration script./var/cache/jboss-ec2-eap/
contains the actual user data, custom script, and custom CLI commands used at instance start-up./var/log
also contains all the logs collected from machine start up, JBoss EAP 6, httpd and most other services.
Chapter 22. Supplemental References
22.1. Download Files From the Red Hat Customer Portal
Prerequisites
- Before you begin this task, you need a Customer Portal account. Browse to https://access.redhat.com and click the Register link in the upper right corner to create an account.
Procedure 22.1. Log in and Download Files from the Red Hat Customer Portal
- Browse to https://access.redhat.com and click the Log in link in the top right corner. Enter your credentials and click Log In.Result
You are logged into RHN and you are returned to the main web page at https://access.redhat.com.
Navigate to the Downloads page.
Use one of the following options to navigate to the Downloads page.- Click the Downloads link in the top navigation bar.
- Navigate directly to https://access.redhat.com/downloads/.
Select the product and version to download.
Use one of the following ways to choose the correct product and version to download.- Step through the navigation one level at a time.
- Search for your product using the search area at the top right-hand side of the screen.
Download the appropriate file for your operating system and installation method of choice.
Depending on the product you choose, you may have the choice of a Zip archive, RPM, or native installer for a specific operating system and architecture. Click either the file name or the Download link to the right of the file you want to download.
The file is downloaded to your computer.
22.2. Configure the Default JDK on Red Hat Enterprise Linux
alternatives
command.
Important
Note
Prerequisites
- In order to complete this task, you need to have superuser access, either through direct login or by means of the
sudo
command.
Procedure 22.2. Configure the Default JDK
Determine the paths for your preferred
java
andjavac
binaries.You can use the commandrpm -ql packagename |grep bin
to find the locations of binaries installed from RPMs. The default locations of thejava
andjavac
binaries on Red Hat Enterprise Linux 32-bit systems are as follows.Table 22.1. Default locations for
java
andjavac
binariesJDK Path OpenJDK 1.6 /usr/lib/jvm/jre-1.6.0-openjdk/bin/java
/usr/lib/jvm/java-1.6.0-openjdk/bin/javac
Oracle JDK 1.6 /usr/lib/jvm/jre-1.6.0-sun/bin/java
/usr/lib/jvm/java-1.6.0-sun/bin/javac
Set the alternative you wish to use for each.
Run the following commands to set your system to use a specificjava
andjavac
:/usr/sbin/alternatives --config java
or/usr/sbin/alternatives --config javac
. Follow the on-screen instructions.Optional: Set the
java_sdk_1.6.0
alternative choice.If you want to use Oracle JDK, you need to set the alternative forjava_sdk_1.6.0.
as well. Use the following command:/usr/sbin/alternatives --config java_sdk_1.6.0
. The correct path is usually/usr/lib/jvm/java-1.6.0-sun
. You can do a file listing to verify it.
The alternative JDK is selected and active.
Appendix A. Revision History
Revision History | |||
---|---|---|---|
Revision 1.1-4 | Thu Apr 10 2014 | Russell Dickenson , Lucas Costi | |
|